docs(design): C30 — stability discipline: artifacts stable, code movable

Decide #296: no Rust-API stability before 1.0 (no semver, no shims; the
workspace version communicates nothing). Two consumer classes with two
mechanisms — native node crates ride the engine checkout as path deps
(what the scaffolder already emits), external embeddings pin a rev. The
compatibility promise attaches to the artifact plane (C18/C29/invariant
8), never to Rust API, with an erosion guard against 'stable API' claims.

The skeptic pass surfaced that a frozen 0.1.0 disarms the cdylib
handshake's CORE_VERSION refusal; the contract commits the load seam to a
build-identity fingerprint instead (transition tracked as #348).
Decision minutes: #296 (options a-e, rationale).

closes #296

docs/design/INDEX.md

@@ -201,6 +201,13 @@ the repo, not session memory, is the source of truth.
   optional gated document `description`); descriptions never influence
   execution or identity ids, and registered artifacts are never
   retroactively invalidated.
+- **[C30 — Stability discipline: artifacts are stable, code is movable](contracts/c30-stability-discipline.md)** —
+  No Rust-API stability before 1.0 (no semver, no shims): node crates ride
+  the engine checkout as path deps, external embeddings pin a rev, and the
+  cdylib handshake refuses non-identical aura-core builds (build-identity
+  stamp, #348). The compatibility promise attaches to the artifact plane
+  (C18/C29/invariant 8); no surface may claim "stable API" while this
+  contract stands.
 
 ---