Calibration accepts a dirty start: a layer that already carries a token puts it back in the sidecar

[bug3]

Raised by balthasar-2 as F2 on consult 0003-review-scratch, adopted, deferred
here by the user's decision while reviewing #4.

What happens

stageLayer reads a layer's current content as original, and recoveryImage
writes original into the sidecar verbatim. When the layer already carries a
calibration nonce line, the sidecar carries that token, and the sidecar lives
under <repoDir>/.magi/doctor where two of the three seats can read it.

That is not a hypothetical starting state. It is exactly what a crashed or
killed calibration leaves: the nonce line is still in the layer, the next run
stages it as original, and the sidecar carries the old token through both
probe rounds of the new run.

The seat-proposed check was refused by the planner for naming node, so it was
read and run by hand. It prints true:

node --input-type=module -e 'import {recoveryImage} from "./src/doctor/calibration-layers.ts"; const nonce="magi-canary-residue"; const original="MAGI calibration nonce: "+nonce+"\n"; const image=recoveryImage([{harness:"claude",path:"/h/.claude/CLAUDE.md",kind:"appended",original,mutated:original+nonce}],nonce); console.log(image.includes(nonce));'

Why it is not urgent

magi doctor already fails on a nonce left in a live layer (hasNonceMarker,
calibration-health.ts:71), so an operator who runs doctor is told. What is
missing is that calibrateCanaries itself does not refuse: --calibrate from
that state reproduces the leak rather than stopping.

What would settle it

Refuse to stage a layer that already carries NONCE_MARKER, naming the file and
pointing at hand recovery, rather than calibrating over it. A dirty start is a
state a person has to resolve, not one to measure through.

A guard belongs with it: a fixture whose layer starts with a nonce line must
make calibrateCanaries reject, and the sidecar must not be written at all.