feat/a-host-adopts-a-membership-at-start
main
The rescue path: an operator writes the membership file by hand on a machine no bus can reach — rotated while it still held the old password — and restarts the host. Same file, same check as the declaration path.