feat(research,campaign,cli): chunked instrument-major cell walk + duplicate-instrument refusal

Two pieces of the parallel-cell-loop iteration (spec: parallel-cell-loop),
still sequential — behaviour-identical results, suite green unchanged:

- validate_campaign refuses a campaign document listing the same instrument
  twice (DocFault::DuplicateInstrument + CLI prose). A duplicate enumerates
  two identical cells and is the one input that could make two cells share a
  registry family name; with distinct instruments the per-cell family name
  (all four cell axes + stage ordinal) is unique by construction, so the
  upcoming parallel appends can never race one name's run-index assignment.
- aura_campaign::execute flattens the 4-nested cell loop into a document-
  order-indexed cell list, groups it by instrument ordinal, and walks
  sequential chunks of K instrument groups; results land in index-addressed
  slots and the ordered outputs (outcomes, realizations, nominee groups) are
  rebuilt in document order. K arrives as a new NonZeroUsize parameter
  (default DEFAULT_PARALLEL_INSTRUMENTS = 4), exposed as
  --parallel-instruments on aura campaign run and threaded through the
  run_campaign chain; the dissolved-verb sugar paths pass the default.

The chunk walk is the structural RAM bound for the parallel flip that
follows: no cell of an instrument outside the current chunk can be in
flight at all (chosen over a semaphore gate — blocking inside pool tasks
risks worker starvation; decision log on #277). Verified: workspace suite
green unchanged, clippy -D warnings clean, E2E fixtures pin the CLI prose
and the document-order persistence across K.

refs #277

crates/aura-cli/src/research_docs.rs

@@ -137,6 +137,9 @@ pub(crate) fn doc_fault_prose(f: &DocFault) -> String {
             format!("pipeline[{stage}]: walk_forward {field} must be > 0")
         }
         DocFault::EmptyInstruments => "data.instruments is empty".into(),
+        DocFault::DuplicateInstrument { index, instrument } => {
+            format!("data.instruments[{index}]: \"{instrument}\" is listed more than once")
+        }
         DocFault::NoWindow => "data.windows is empty".into(),
         DocFault::BadWindow { index } => {
             format!("data.windows[{index}]: from_ms must be earlier than to_ms")
@@ -313,7 +316,13 @@ pub enum CampaignSub {
     Register { file: PathBuf },
     /// Execute a stored campaign into a realized run-set (a .json file is
     /// register-then-run sugar; the canonical address is the content id).
-    Run { target: String },
+    Run {
+        target: String,
+        /// Bound on distinct instruments resident in parallel (the RAM
+        /// lever; 1 reproduces the sequential loop's footprint).
+        #[arg(long, default_value_t = aura_campaign::DEFAULT_PARALLEL_INSTRUMENTS)]
+        parallel_instruments: std::num::NonZeroUsize,
+    },
     /// List stored campaign realizations, or dump one campaign's records
     /// (the bare store lines, not the run-emit wrapper).
     Runs { campaign: Option<String>, run: Option<usize> },
@@ -420,8 +429,12 @@ fn campaign_runs(campaign: Option<&str>, run: Option<usize>, env: &Env) -> Resul
 /// via `exit_on_campaign_result`), so it is pulled out of the unified
 /// `Result<(), String>` match the other four subcommands still share.
 pub fn campaign_cmd(cmd: CampaignCmd, env: &Env) {
-    if let CampaignSub::Run { target } = &cmd.sub {
-        crate::exit_on_campaign_result(crate::campaign_run::run_campaign(target, env));
+    if let CampaignSub::Run { target, parallel_instruments } = &cmd.sub {
+        crate::exit_on_campaign_result(crate::campaign_run::run_campaign(
+            target,
+            env,
+            *parallel_instruments,
+        ));
         return;
     }
     let result = match &cmd.sub {