feat(aura-runner, aura-cli): RunnerError propagation — the assembly crate stops killing the host

All 14 process::exit sites in aura-runner (member x8, measure x5,
translate x1) convert to RunnerError { exit_code, message } propagation;
run_signal_r / run_measurement return Result tuples carrying the
skipped-tap names beside the C18 reports (record shapes untouched), and
the CLI owns printing via the shared exit_on_runner_error arm (the
dispatch_reproduce pattern — reproduce now uses the same helper).
cost_knob becomes fallible: the sweep worker maps it into the cell's
MemberFault (closing the one hole in 'a worker never process-exits'),
the persist path keeps its string channel. The skipped-tap note is
CLI-printed from returned data, byte-identical.

The one deliberate behaviour change is the minuted C14 adjudication:
refusals in the content of what argv named (binding, synthetic mismatch,
compile, tap-bind content, exposes-neither) move exit 1 -> 2; the
boundary is FORM vs VALUE — an out-of-domain override value keeps the
runtime class via the panic containment, matching the campaign leg.
Environment/data/IO refusals stay 1 (TapPlanError::exit_class is the
single source). Named re-pins in exec.rs, run_refuses_unrunnable_
blueprint.rs, tap_recording.rs, graph_construct.rs; new library-level
test pins the milestone promise (a refusal returns in-process, the
embedding host survives). Prose is byte-identical everywhere.

Docs in lockstep: C28 deferred block closed (14 sites, hole closed),
C14 partition + form-vs-value boundary, C27 note emission, guide exit
classes. Fork minutes: issues/297#issuecomment-4868 and -4873.

closes #297

crates/aura-cli/tests/graph_construct.rs

@@ -2478,7 +2478,8 @@ fn running_an_open_blueprint_refuses_at_bootstrap() {
     let bp = dir.join("open.bp.json");
     std::fs::write(&bp, &build_out).expect("write built blueprint");
     let (stdout, stderr, code) = run_in(&dir, &["exec", bp.to_str().unwrap()]);
-    assert_eq!(code, Some(1), "an open blueprint refuses standalone at bootstrap, not finish: {stdout} {stderr}");
+    // C14 class 2: fault in argv-named content (#297)
+    assert_eq!(code, Some(2), "an open blueprint refuses standalone at bootstrap, not finish: {stdout} {stderr}");
     assert!(stdout.is_empty(), "no report emitted on a bootstrap refusal: {stdout}");
     assert!(
         stderr.contains("root role \"price\" is unbound"),