startup guard: disjoint populated ledger and reality fleets are accepted #69

What happened

The startup guard compares only aggregate ledger and reality emptiness. It cannot verify identity overlap when both sides are populated, despite destructive startup reconciliation.

Reproduction:

1. Seed ledger row ledger-a.
2. Expose only local container and disk reality-b.
3. Call the startup guard with ledger count 1.
4. If it permits startup, run startup reconciliation.

Expected: The daemon should refuse because the populated ledger and local reality cannot belong together.

Actual: The guard returns no refusal. Startup reconciliation deletes ledger-a as unmatched and destroys reality-b and its disk as orphaned.

Impact: Selecting an unrelated ledger, executor environment, or data directory can delete one fleet's ownership rows and physically destroy the other fleet's local resources.

dor doctor output

Not applicable — the destructive mismatch was reproduced through the focused startup guard and reconciler and does not depend on general host readiness. dor doctor was not run.

Environment

• Reproduction mode: Focused-source reproduction
• Dormice commit: 4417ae14938273f5d937c476cf7cdc57e22e53a5
• Verification: Verified against current startup guard and reconciler main at 4417ae14938273f5d937c476cf7cdc57e22e53a5.