Require force to exclude coordinators

I'm creating this issue to elicit some discussion, I'm not certain yet whether this is a good idea.

Excluding coordinators is currently legal and does not change the coordinators in any way. This poses an operational risk if someone assumes the process is safe to remove because it has successfully been excluded. Adding an error and requiring force makes it harder to make a mistake like this.

There are different options for how to implement this -- you could disallow excluding any coordinator, or only disallow an exclude if the removal of those processes would bring the cluster down (e.g. if you exclude too many coordinators).

I think the main question in deciding whether to do this is to enumerate what workflows use exclude but don't want to remove the process, in which case this check adds an extra hurdle. We would then need to decide if that is worth it.

No files, tests, or entry points are named. First resolve the proposed behavior and identify which exclude workflows must remain supported; done would require an agreed policy for coordinator exclusion and corresponding implementation and validation.

Written by the indexing model from the issue text.