audit: cycle-close tidy for #277 — preflight duplicate refusal, zero-bound pin, C1 realization note

Resolutions for the architect's four drift items (all fix/document, none
ratified away):

- [medium] execute enforced family-name uniqueness only via the CLI's
  validate tier: preflight now refuses duplicate campaign instruments
  itself (defense in depth for direct callers), RED-first
  (execute_refuses_duplicate_instruments).
- [medium] the parallel cell loop's C1 relationship lived only in the
  git-ignored spec: C1 gains a realization note (docs/design/INDEX.md)
  recording the chunked instrument-major schedule, the structural
  residency bound, and the two scheduling-dependent fatal-path carve-outs
  (fault attribution among completed cells; already-written family lines)
  — both inert and outside the success-path bit-identity.
- [low] the fatal-path orphan-line honesty is part of that note.
- [low] the --parallel-instruments zero-reject acceptance criterion had no
  protecting test: campaign_run_rejects_a_zero_parallel_instruments_bound
  pins clap's NonZeroUsize usage error (exit 2).

Gates re-verified: workspace suite green, clippy -D warnings clean.

refs #277

docs/design/INDEX.md

@@ -125,6 +125,25 @@ same cell re-run under `aura generalize`) may differ by floating-point reassocia
 operation order (IEEE-754 non-associativity). This is not a C1 violation: C1 governs
 the determinism of a single run, not the cross-command bit-identity of a re-derived
 statistic.
+**Realization note (2026-07-16, #277).** Cross-sim parallelism now also spans
+campaign cells: the executor flattens the cell matrix, groups it by instrument
+ordinal, and walks sequential chunks of K instrument groups
+(`--parallel-instruments`, default 4 — a structural bound on distinct resident
+instruments, the RAM lever for the external data-server's per-reference file
+retention); within a chunk, cells run concurrently on the process-global rayon
+pool shared with the member/window fan-out. Results are collected into
+document-order slots, so outputs stay byte-identical across worker counts and
+bounds. Two deliberate scheduling-dependent carve-outs, both outside this
+contract's per-run bit-identity (which governs successful runs): on the
+run-fatal path (non-containable faults, e.g. a dead registry store) the
+propagated fault is the lowest document-order fault among the cells that
+completed before the abort flag latched, and the set of per-cell family lines
+already written by then is scheduling-dependent — inert, because no
+campaign-run record is written on that path and store reads are name-keyed,
+never line-ordered. Duplicate campaign instruments are refused at both the
+validate tier and the executor's preflight: the per-cell family name embeds
+the raw instrument string, so uniqueness is what keeps concurrent appends from
+racing one name's run-index assignment.
 **Forbids.** Concurrency *within* a single sim; any nondeterministic input that
 is not captured as an explicit input (see C11, C12).
 **Why.** Real money rides on backtest results; reproducibility and an audit