audit: cycle-close tidy for #277 — preflight duplicate refusal, zero-bound pin, C1 realization note

Resolutions for the architect's four drift items (all fix/document, none
ratified away):

- [medium] execute enforced family-name uniqueness only via the CLI's
  validate tier: preflight now refuses duplicate campaign instruments
  itself (defense in depth for direct callers), RED-first
  (execute_refuses_duplicate_instruments).
- [medium] the parallel cell loop's C1 relationship lived only in the
  git-ignored spec: C1 gains a realization note (docs/design/INDEX.md)
  recording the chunked instrument-major schedule, the structural
  residency bound, and the two scheduling-dependent fatal-path carve-outs
  (fault attribution among completed cells; already-written family lines)
  — both inert and outside the success-path bit-identity.
- [low] the fatal-path orphan-line honesty is part of that note.
- [low] the --parallel-instruments zero-reject acceptance criterion had no
  protecting test: campaign_run_rejects_a_zero_parallel_instruments_bound
  pins clap's NonZeroUsize usage error (exit 2).

Gates re-verified: workspace suite green, clippy -D warnings clean.

refs #277

crates/aura-cli/tests/research_docs.rs

@@ -4075,3 +4075,12 @@ fn campaign_over_a_gapped_archive_records_the_uncovered_cell_and_continues() {
         "the campaign-run summary names the one failed cell: {out}"
     );
 }
+
+/// Acceptance pin (#277): `--parallel-instruments` rejects 0 at parse time —
+/// the NonZeroUsize carrier makes a zero residency bound unrepresentable, so
+/// clap refuses it as a usage error (exit 2) before any target resolution.
+#[test]
+fn campaign_run_rejects_a_zero_parallel_instruments_bound() {
+    let (out, code) = run_code(&["campaign", "run", "unused", "--parallel-instruments", "0"]);
+    assert_eq!(code, Some(2), "clap usage error expected, got: {out}");
+}