audit(0084): cycle close — drift-clean (code); C10 cycle-0084 note + doc fixes

Cycle 4 of milestone #148 (cost-graph composite-builder). Architect drift review
over fc52b4f..d5c44dd: drift_found, every item dispositioned.

What holds (architect, evidence-of-review): C16/C9 — cost_graph lives in
aura-composites, the factors in aura-std, aura-engine stays domain-free; the
composite is ordinary downstream nodes. C11 behaviour-preservation is structural,
not just asserted — the composite inlines to the same flat fan-in as the deleted
CLI block (identical node set/order, cost[k].field slot map, geometry fan, net_eq
terms/signs, cost_rec cols), so the cycle-0083 net_expectancy_r goldens stay
byte-identical. C23 — role/port names non-load-bearing; 4 fixtures pin the role-set
+ output triple.

Resolved this commit:
- [high] ledger C10: the cycle-0083 note's "Still deferred (decision E)" is removed
  (E shipped this cycle) and a cycle-0084 realization note added.
- [medium] cost_graph .leak() provenance (aura-composites/src/lib.rs): the
  "risk_executor precedent" was imprecise — that .leak() lives in risk_executor's
  TEST (one-shot, leak-safe), not its production builder. Doc corrected: the leak is
  fine for one-shot run-path construction but must be interned (the COL_PORTS
  production pattern) before cost reaches the sweep path.
- [low] cli_run.rs golden docstring cited the deleted `slot * COST_WIDTH + f` CLI
  wiring; updated to the cost_graph composite's per-node cost[k].<port> wiring.

Deferred (tracked, not pending) -> #152:
- [medium] the cost[k].<port> index-namespacing restated across CostSum / cost_graph
  / the CLI (a build-validated lockstep — a divergent name fails loudly at g.build(),
  NOT the silent positional kind 0083 collapsed), AND the per-build .leak() that
  becomes an allocation regression on the per-member sweep path. Both are harmless on
  the current run-only cost path; the proper fix is one sweep-safe single-source
  cost-port-name contract (interned), best built with the deferred sweep-cost cycle.

Regression gate: cargo test --workspace (0 failures), clippy --workspace --all-targets
-- -D warnings clean, cargo doc clean — the architect is the primary gate (no dedicated
regression script). Ephemera (spec 0084 + plan 0084) git rm'd.

Milestone "Cost-model graph (in R)" remains OPEN.

refs #148

docs/design/INDEX.md

@@ -776,9 +776,27 @@ remains the non-load-bearing symbol). **Behaviour-preserving**: the builders emi
 unchanged schemas, so the wiring / `net_r_equity` seam / `summarize_r` are untouched and
 the `numerator / latched` token form is byte-identical; the existing suite passes
 verbatim and two new CLI characterization goldens pin the exact flat/composed
-`net_expectancy_r` (the prior tests only asserted `net < gross`). **Still deferred**
-(decision E): the multi-node cost-graph composite-builder (wiring sugar over the
-already-working edge-wired seam). Decision log: #148.
+`net_expectancy_r` (the prior tests only asserted `net < gross`). Decision log: #148.
+
+**Realization (cycle 0084 — cost-graph composite-builder, cycle 4, #148).** Decision E
+ships. A new `cost_graph(Vec<PrimitiveBuilder>) -> Composite` in `aura-composites` (the
+C16 layer that couples the engine builder + `aura-std` nodes) is the cost-model graph's
+**authoring primitive**: it fans the 4 PM-geometry inputs to `N` cost nodes, surfaces
+each node's extra inputs (discovered via `schema().inputs[GEOMETRY_WIDTH..]`,
+`GEOMETRY_WIDTH` now re-exported from `aura-std`) as `cost[k].<port>` composite roles,
+sums them through `CostSum`, and exposes the 3-field aggregate. The CLI's manual
+slot-indexed cost-wiring + the hardcoded `MAX_RUN_COST_NODES = 2` cap are deleted — the
+composite handles arbitrary arity. **Behaviour-preserving** (C11): the composite inlines
+at bootstrap to the same flat fan-in, so the cycle-0083 `net_expectancy_r` goldens are
+byte-identical (four `aura-composites` unit tests pin the exposed role-set + output
+triple, incl. arbitrary-arity per-node namespacing). Honours C9 (ordinary downstream
+nodes), C16 (wiring stays out of `aura-engine`), C23 (role/port names are
+non-load-bearing). **Carried debt (#152, for the deferred sweep-cost cycle):** the
+`cost[k].<port>` index-namespacing is restated across `CostSum` / `cost_graph` / the CLI
+(a build-validated lockstep, not the silent positional kind 0083 collapsed), and
+`cost_graph` `.leak()`s runtime port names per build — fine for one-shot run-path
+construction, but to be interned (the `COL_PORTS` production pattern, not the test-only
+`.leak()`) before cost reaches the per-member sweep path. Decision log: #148.
 
 **Reframe (2026-06-23, #117 — exposure → bias, R as the signal-quality unit).**
 [HISTORY — its R spine survives into the 2026-06-28 contract; its Stage-2 currency /