New safety checks on exclusions that could take a database unavailable

When we're running in a multi-DC configuration, it's possible to run an exclusion that can take the database unavailable. For instance, if a database is configured to run satellite logs, but we exclude all of the satellite processes, the database would go unavailable. Should we add a safety check in the exclusion to prevent this kind of mistake?

On a related note, it's possible that an exclusion could put the database into a configuration that is viable but undesirable. For instance, if a database is configured to run 5 proxies, but we exclude all of the stateless class processes but 1, the database will go down to 1 proxy, and it will put that proxy on that single process along with all of the other stateless roles. Should we add safety checks for this kind of thing as well?

The issue names no files, tests, or entry points. Start by locating the exclusion handling and the multi-DC database availability logic, then determine which excluded configurations must be rejected and which merely need warnings. Done means the safety policy is agreed and covered by implementation tests for both unavailable and undesirable configurations.

Written by the indexing model from the issue text.