[SamHatoum]

What this changes

When the ledger's database was made by another version of Auto Runtime, the runtime refuses to start, as it is meant to: nothing is carried over before launch. But the words it stopped with were the ledger's own sentence wrapped twice, StartupError: The server's services could not start: Error: ..., telling the person to delete "the local database" without saying where it was, and telling a ledger in PostgreSQL to delete a local file it does not have.

Now:

• The ledger refuses such a table as a LedgerShapeRefused, naming the table, what it holds, and the columns found and kept. Its message is unchanged.
• The server turns that refusal into its own words, since it knows where the ledger is kept: the file's absolute path, or the PostgreSQL database and its host, never the URL; that this version keeps that data in a different shape and cannot read what this ledger holds; what to do; and where to ask. Where the ledger is kept is said by one function, shared with the start log.
• Started in a terminal, the runtime shows this as a notice beneath the logo, styled like the ready notice, with the three files to delete named one by one, the ledger file and the -wal and -shm files SQLite keeps beside it, each quoted for the shell, so the command works in every POSIX shell and on a path with a space or a quote. In the image, where the files are on a volume, the notice says which files to delete from the volume instead of a command. A ledger in PostgreSQL is told to point DATABASE_URL at an empty database.
• Started as a server (the image, or main.ts), the runtime says the same thing on its single line of stderr, with no class name before the words, and that line is now the default for every server, the test entries included.
• Any other failure to start reads as before. StartupError keeps the failure it wraps as its cause, which is how the notice finds the refusal. Colour and link codes follow whether stderr is a terminal.

What the terminal shows:

  ✖ Auto Runtime could not start

  The ledger is kept in the file /Users/ada/.auto-runtime/ledger.db, and was
  made by another version of Auto Runtime. This version keeps secrets in a
  different shape and cannot read the secrets this ledger holds.

  What you can do
    Delete the ledger and start Auto Runtime again. Everything in the ledger
    goes with it, every playbook, definition, run and connection among it.

      rm -f /Users/ada/.auto-runtime/ledger.db /Users/ada/.auto-runtime/ledger.db-wal /Users/ada/.auto-runtime/ledger.db-shm

  Need a hand? Ask us on Discord: https://discord.gg/B8BKcKMRm8

  kept_secrets has the columns held, id, kept_at, kept_by, version, where
  this version keeps claimed_until, ends_with, held, id, kept_at, kept_by,
  kid, version, wrapped_key.

Tests

• The ledger's secrets behaviour checks the refusal's type and fields.
• ledger-of-another-version.test.ts covers the words for a file, a relative path, PostgreSQL and the image, and runs the delete command in a real folder whose name holds a space, a quote and a $.
• failure-notice.test.ts checks the terminal notice line by line, with and without colours.
• ledger-database.test.ts checks that the layer turns the refusal into the server's error and passes any other failure through unchanged.
• run-server.test.ts, ledger-startup.test.ts and terminal-control.test.ts start a real server and a real auto-runtime on a ledger of another version and read what each prints, including stderr sent to a file.

Checklist

• The PR title is a conventional commit with a workspace scope, such as feat(reasoning): .... It becomes the squash commit and the changelog entry.
• pnpm check passes locally, with every file at 100% coverage.
• I've signed the Contributor License Agreement (the CLA bot asks on your first PR).