Hold the trust-before-push order by a test, and refuse early what would stop it (issue 92)

The fix is an order, and nothing failed if the trust call moved after the
push or went: steps 7 and 8 are now one function a test drives against a
runtime that refuses an untrusted push. Preflight now refuses, before
anything is raised, a runtime file that is no JSON object, a docker.service
that is not loaded and active, and a dockerd started with
--insecure-registry, which would refuse the reload. The comment names the
order the docker module's takeover rests on.

internal/bootstrap/preflight.go

@@ -110,6 +110,13 @@ func Preflight(ctx context.Context, o Options, d Deps, say func(string)) ([]byte
 	if err := RefuseAMachineInUse(ctx, o, d.Run, say); err != nil {
 		return nil, err
 	}
+	// The registry's trust is written at step 7, before the push (novox/hq issue 92). What can be
+	// known about whether it will take, without writing anything, is asked now.
+	if o.pivots() {
+		if err := RuntimeWillTakeTheTrust(ctx, o, d.Run, say); err != nil {
+			return nil, err
+		}
+	}
 
 	// 4. Can this machine reach what the bundle's images come from?
 	//