Prompt 1.3: Replace imaginary --backend-shape-report with real -o output

The audit document referenced a --backend-shape-report CLI flag that
does not exist. Replaced it with the actual cellc -o workflow that
produces ELF + .meta.json, and documented the four evidence sources
for backend shape auditing:

1. ELF header validation
2. .meta.json inspection (runtime features, obligations, fail-closed)
3. Source-level RISC-V emit path inspection
4. Negative confirmation of runtime-required vs over-lowered

Added explicit decision note: do not add --backend-shape-report for
0.15; it is a valuable 0.16+ compiler evidence feature, not a 0.15
release blocker.

Author: a19q3

docs/CELLSCRIPT_0_15_PRE_RELEASE_AUDIT_AND_HARDENING.md

@@ -78,14 +78,24 @@ cargo test --locked -p cellscript docgen --lib
 ### 1.3 后端形状稳定性
 
 ```bash
-# 生成后端形状报告
-mkdir -p target/cellscript-backend-shape
+# 生成后端审计产物（ELF + metadata）
+mkdir -p target/cellscript-audit
 cargo run --locked -p cellscript -- \
   examples/token.cell \
   --target riscv64-elf --target-profile ckb --primitive-strict 0.15 \
-  --backend-shape-report target/cellscript-backend-shape/backend-shape-report-main.json
+  -o target/cellscript-audit/token.elf
 ```
 
+**Expected artifacts**：
+- `target/cellscript-audit/token.elf`
+- `target/cellscript-audit/token.elf.meta.json`
+
+**Backend shape evidence is collected from**：
+1. ELF header validation (`xxd -l 4` → `\x7fELF`).
+2. Generated `.meta.json` inspection (runtime features, verifier obligations, fail-closed list).
+3. Targeted source inspection of RISC-V emit paths (`emit_create_unique`, `emit_replace_unique`, `emit_destroy`).
+4. Negative confirmation that unsupported policies remain `runtime-required` rather than being over-lowered.
+
 **Prompt**：
 > 作为后端审计员，验证：
 > - 生成的 RISC-V ELF 以 `\x7fELF` 开头。
@@ -95,6 +105,8 @@ cargo run --locked -p cellscript -- \
 > - `destroy_instance` 和 `burn_amount` 明确标记为 metadata-visible runtime-required，不发射 over-broad 的 TypeHash scan。
 > - 没有新增的未处理 IR pattern 导致 panic 或默认分支。
 
+**Decision**：Do not add `--backend-shape-report` for 0.15. The audit document was ahead of the current CLI surface. A dedicated backend-shape report is a valuable 0.16+ compiler evidence feature, not a 0.15 release blocker.
+
 ---
 
 ## 审计阶段二：语法组合预飞行