Rollout proof requires separate local and fleet activation states

Treat merged, generally available, locally active, and fleet-confirmed as separate rollout states. A healthy local check proves one host is active, not fleet-wide activation. Aggregate monitoring can combine sanitized attempt and approval-state totals while discarding candidate content; it does not prove every host has updated.