docs(P16): complete workflow-parity-and-script-flags phase (v1.13.19)

---ci---
project: acdl
phase: 16
milestone: v1.14
status: complete
requirements:
  covered: [REQ-150]
  partial: []
---/ci---

scripts/rotate_spike_key.sh

@@ -13,7 +13,7 @@
 #
 # Spike scope (D-039): the spike user key is per-run-rotated; real OIDC is
 # v1.2 (blocked on go-gitea/gitea#36988).
-set -u
+set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
 ENV_FILE="$ROOT/.env.secrets"