Draft: docs: the S16 Step 14 split, its plan corrections, and four S16 spec fixes

The standing catcher for Step 14's plan and spec amendments. Step 17's half moved to !1939, which does the same job for Step 17.

While the Step 14 stack is in review, plan and spec corrections that come out of those MRs land here rather than on the step MRs themselves, so a step MR is never blocked waiting on a plan edit. Guardrail 4 blesses the shape: "maintain them in one standing table MR while a workstream has steps in flight."

Goes for review once 14-4 (!1875) has merged. 14-3 (!1873) and 14-4 are still in flight and 14-4 has not been reviewed, so more amendments are likely.

What changed

The Step 14 split. Step 14 becomes four stacked MRs cut around its activations, with a per-MR table naming each part's files, tests, and merge order. The step keeps one Status table row listing all four, because the parts are an MR-split of one deliverable sharing one dependency set and one acceptance list. The 14-1 to 14-4 ids live in the entry's own table and name no Status row, so a title marker reads 14/26. Records !1869 (merged), !1872 (merged), !1873 and !1875 in that row.

Step 14's gating. Re-gates the disagreeing-Docker-Content-Digest criterion. Corrects the three entries that said the criterion loses its detection half when !1807 merges: !1807's comparison is a per-fetch opt-in that nothing sets, so the merge moves what the criterion is gated on rather than closing half of it.

Four S16 spec fixes.

• Corrects npm's credential shape in the item-9 entry. npm carries a bearer token, not a credential pair.
• Drops the claim that the container builder leaves the credential half open. UpstreamRequestBuilder already resolves Authorization inside BuildRequest.
• Conditions the Digest verification guarantee on whether the fill passed an expected digest, rather than claiming discard-before-commit absolutely.
• Conditions the three other sites that stated the by-digest discard absolutely and so contradicted it: the streamed-blob acceptance criterion under Cache integrity and body caps, and the two Error Cases rows for a body that does not match the requested digest. Each is worded in its own terms rather than repeating the guarantee's sentence.

Not in this MR

• Step 17's plan text and its two spec fixes. On !1939.
• Work item #320's item 9, which says nothing composes SingleFlight on main when both Maven and npm do. That is a work-item body edit, not a diff.
• The tag-side Docker-Content-Digest cross-check row still states the discard absolutely. That gap is unimplemented and out of scope here.