Make how the target version is started a seam

Both phases that bring the target version up against a not-yet-migrated
store -- the recovery cycle, and the ordinary boot validate does after it --
constructed a child process from a path on this host directly. That is the
one thing about them packaging changes: a container runs an image against
the data volume instead. Everything either of them is started *for* is
identical afterwards.

So starting it is now a Launcher, returning a Supervised the callers stop
and read output from. BinaryLauncher is today's behaviour and the default
when Options.Launcher is nil, so every existing caller is unchanged -- no
test needed editing, which is the evidence for that rather than a claim
about it.

Deliberately narrower than the interface sketched in issue #3. Stage and
cutover also differ by packaging, but designing their interfaces now would
be designing against a guess: there is no second implementation yet to
shape them, and the shape a container needs is what PR 3 and PR 4 find out.
This seam is different because it already had two callers doing the same
thing for the same reason, so extracting it describes the code rather than
predicting it.

outputSuffix now takes Supervised. It only ever needed Output(), and the
diagnosis it exists to preserve -- the server's own words about a bind
conflict or a rejected config value, which a bare timeout loses -- matters
whatever started the process.

internal/validate/bootcheck.go

@@ -29,6 +29,10 @@ type BootCheckOptions struct {
 	StopGrace  time.Duration
 	HTTPClient *http.Client
 
+	// Launcher starts the instance this boots. Nil means BinaryPath as a
+	// child process - see recovery.Launcher.
+	Launcher recovery.Launcher
+
 	// ContentIntegrityBefore, if non-nil, is the pre-migration snapshot
 	// preflight captured (checkpoint.RunState.PreflightSnapshot). When set,
 	// BootCheck captures a fresh snapshot from the instance it just booted
@@ -59,10 +63,14 @@ type BootCheckOptions struct {
 // so a retry just redoes the whole cycle - see recovery.Run's doc comment
 // for the full reasoning, which applies identically here.
 func BootCheck(ctx context.Context, o BootCheckOptions) (detail string, result *ContentIntegrityResult, err error) {
-	proc := &recovery.Process{}
-	if startErr := proc.Start(ctx, recovery.ProcessOptions{
-		BinaryPath: o.BinaryPath, ConfigPath: o.ConfigPath, RecoveryMode: false, ExtraEnv: o.ExtraEnv,
-	}); startErr != nil {
+	launcher := o.Launcher
+	if launcher == nil {
+		launcher = recovery.BinaryLauncher{BinaryPath: o.BinaryPath}
+	}
+	proc, startErr := launcher.Launch(ctx, recovery.LaunchOptions{
+		ConfigPath: o.ConfigPath, RecoveryMode: false, ExtraEnv: o.ExtraEnv,
+	})
+	if startErr != nil {
 		return "", nil, fmt.Errorf("validate: start normal boot: %w", startErr)
 	}