refactor(orchestrator): report startup rollback failures

[LukeMathWalker]

Why

Normal startup failures relied on StartupGuard::drop, which cannot return cleanup errors and may hide blocking rollback work in destructor control flow. Complete rollback should be an explicit lifecycle transition, while Drop should remain only a fail-closed backstop.

What Changed

• run one explicit rollback path for every guarded startup failure
• report planning/startup failures together with rollback failures
• propagate the combined error through the Firma stack boundary
• reserve Drop for hard termination and collection handoff
• retain durable state when destructor cleanup cannot prove safe deletion

Risks / Notes

This changes the error structure when both startup and rollback fail: callers now receive StartError::Rollback instead of only the initiating error. This is the third PR in the lifecycle-ownership stack and targets #484.

AI Assistance

Implementation assisted by OpenAI GPT-5.4.