docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4)

P5 final-review-ship complete: dual-read fallback removed (REQ-164) —
core/env.py NOVA-only, .env.secrets load paths NOVA-only (G-106 retired),
nova_tagging.py hard-fails any acdl:* tag, legacy ACDL_* Gitea secrets
deleted, ACDL_LIFECYCLE_MODE/ACDL_LOCAL_TIER/ACDL_HITL_* exports removed
from scripts, SNS subject → Nova SoD halt (P1-2), bootstrap scripts
NOVA-only. Review: 2 P0 auto-fixed (duplicate delenv), P1-1/P1-2 resolved,
doc-drift fixed. Audit: tags v1.15.0-4 exist; traceability REQ-155..164
all complete; ARCHITECTURE naming table matches codebase. 615 pytest PASS;
run_ci.sh 3-stage PASS. NOVA_MIGRATION.md marked COMPLETE.

---ci---
project: acdl
phase: 5
milestone: v1.15
status: complete
phase_role: final
requirements:
  covered: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164]
  partial: []
---/ci---

core/regression_verify.py

@@ -315,13 +315,10 @@ def _load_aws_env() -> Dict[str, str]:
                     continue
                 if "=" in line:
                     k, v = line.split("=", 1)
-                    # G-106 binding: dual-read NOVA_* first, ACDL_* fallback.
-                    # The .env.secrets keys are renamed to NOVA_* in P2; the
-                    # ACDL_* fallback covers operators who haven't rotated
-                    # their local .env.secrets yet. Removed in P5.
-                    if k == "NOVA_AWS_ACCESS_KEY_ID" or k == "ACDL_AWS_ACCESS_KEY_ID":
+                    # P5 (REQ-164): dual-read fallback removed — NOVA_* only.
+                    if k == "NOVA_AWS_ACCESS_KEY_ID":
                         env["AWS_ACCESS_KEY_ID"] = v
-                    elif k == "NOVA_AWS_SECRET_ACCESS_KEY" or k == "ACDL_AWS_SECRET_ACCESS_KEY":
+                    elif k == "NOVA_AWS_SECRET_ACCESS_KEY":
                         env["AWS_SECRET_ACCESS_KEY"] = v
                     elif k == "AWS_DEFAULT_REGION":
                         env["AWS_DEFAULT_REGION"] = v