The verdict in abi_flat_safety describes the *flat* object, and building a
per-minor copy does not change it, so the repair list stays the same after a
run. The first fleet repair was interrupted at 14 of 18 slots having uploaded
2568 objects; resuming would have rebuilt every one of them again.
An object is repaired once a per-minor build exists for every minor that cannot
load the flat one, and the bucket is the source of truth for that. Where no
minors are recorded -- unsafe without a reason -- a build under every minor the
image carries is required, rather than assuming one is enough.
This change will:
- list the slot's objects from S3 and drop the rows already covered
- report how many were skipped, so an unexpectedly short list is visible rather
than silent
- fail rather than proceed when the bucket cannot be listed, since an empty
listing would make everything look unrepaired