Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)

v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.

561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).

---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---

scripts/run_l2_lifecycle_destroy.sh

@@ -1,11 +1,18 @@
 #!/usr/bin/env bash
 # scripts/run_l2_lifecycle_destroy.sh — run a single L2 module lifecycle destroy.
 #
-# Usage: run_l2_lifecycle_destroy.sh <module> [ci-vpc-outputs.json]
+# Usage: run_l2_lifecycle_destroy.sh <module>
 #
 # Wraps run_platform.sh for L2 composition modules in the modules-lifecycle
 # pipeline. Sets ACDL_REMOTE_STATE_KEY to point to the CI VPC state.
 #
+# NOTE: unlike the L1 scripts (run_lifecycle_destroy.sh), the L2 path does
+# NOT take a ci-vpc-outputs.json argument. L2 compositions reference the
+# platform VPC via terraform_remote_state (a data source), not by injecting
+# VPC outputs into the contract. The workflow passes 2 positional args for
+# parity with the L1 matrix, but $2 is accepted-but-ignored here (documented,
+# not a bug).
+#
 # Lifecycle mode (REQ-134): ACDL_LIFECYCLE_MODE default "plan" = no-op
 # (plan mode never applies resources, so there is nothing to destroy).
 # Set to "full" for the real `--destroy` against live AWS.