[douglasjarquin]

Summary

A bare init in the designated installation now makes sure the pinned local HC core has a current holder.
It still returns the developer role and does not claim the coordinator.
The core was up with no holder, so coordinator start failed before it created a terminal.
hc server start did not repair that, and a restart alone did not create the holder until a program ran.

The ensure path starts a stopped core.
It restarts a holderless core only when nothing is live.
If the holder is still missing, it runs true, removes that terminal, and checks again.
An explicit developer init, a development checkout, a missing pinned hc, and a holderless core with live terminals do not start or restart anything.

Validation

• I followed the contributor checklist. The change is limited to this behavior, but the full verifier was not run.
• I recorded the canonical verification command, result, and evidence path. Not run. mise run verify was not executed, and there is no .artifacts/verification/ record. MISE_ENABLE_TOOLS=go mise exec -- go test ./internal/hcboot ./internal/cli -count=1 -timeout 180s -run 'TestEnsure|TestBareInitEnsures|TestInitUnboundDesignated|TestInitExplicitAuthority' passed in the dev checkout.
• I recorded applicable manual or live checks, including anything not run. No live init was run against the real HC core for this change.
• I stated deployment or release impact when relevant. No release is staged. The checkout runtime uses the compiled .local/bin/sumctl, so this behavior starts only after that helper is rebuilt from the merged tree.

Human review and the branch-protection owner decide merge readiness.