X5: implement the boot-time confidential-VM assertion

The coordinator asserts in its own documentation that it decrypts request bodies inside confidential-VM memory, but **nothing in the process verifies this at runtime**. `grep -rni confidential coordinator --include=*.go` returns only comments.

The consequence, stated in the 2026-07-17 migration runbook that first raised this: omitting the confidential-compute flag silently produces a non-confidential VM where the host can read decrypted prompts, with zero error. That runbook listed a boot-time assertion as a Phase-1 blocker; it was never implemented.

### Work
- At startup, verify the process is running on a Confidential VM and **refuse to serve** if not
- Fail closed and loudly — a misconfigured host must not come up serving traffic
- Consider an operator-visible surface (health payload or telemetry) so the property is observable, not just asserted at boot
- Tests that cover both the confidential and non-confidential cases without needing a real CVM in CI

Build and test it in dev, where a false negative costs nothing. It benefits production directly.

### Sequencing
Deliberately **after** the Phase A exit criteria, so a failing assertion cannot block the environment coming up.

### Acceptance criteria
- [ ] Coordinator refuses to start on a non-confidential host
- [ ] Verified positively on the dev Confidential VM
- [ ] Documented in the encryption architecture page

Start in the coordinator Go process using `grep -rni confidential coordinator --include=*.go`, then trace its startup path and current health or telemetry surface. Read the 2026-07-17 migration runbook and encryption architecture page for the intended requirement. Done means startup fails closed on non-confidential hosts, both host cases are tested without a real CVM, and the behavior is documented and verified in the dev Confidential VM.

Written by the indexing model from the issue text.