feat(backups): tell an empty ledger apart from an empty bucket

On the release that adds the ledger the table is empty, so on a host that has
been uploading nightly for months every account read Never, under a sentence
saying no copy had ever reached the bucket. That sentence is untrue on exactly
the morning an operator opens the new card for the first time, and it is a
claim the host cannot make: what is empty is the record, not the bucket.

The run now records every account it walks, not only the ones an object came
of. A walk that produced nothing moves the attempt instant and leaves the
success columns alone, so the two cases separate: no row at all is no record
yet, a row without a success is never. Never now means what the word says —
a run looked at this account and has never put anything there.

The card names the last check on the never row, so the state is a fact with a
timestamp rather than an assertion. Runbook and all seven bundles carry the
same two sentences. The integration file proves both arms against real
Postgres, including that a failed run leaves the previous good copy on the
row.

docs/ops/backup-restore.md

@@ -225,8 +225,16 @@ failed` each time, which looks like weather.
 host last put that account's encrypted copy in the bucket, how big it was, and
 how that compares with the nightly schedule. **Fresh** is inside one run,
 **due** means one run produced nothing for that account, **stale** means two
-did not, and **never** means no object has ever landed. On a host without
-`BACKUP_S3_*` the card says off-host backup is not configured and stops there.
+did not, **never** means a run walked the account and no object has ever
+landed for it, and **no record yet** means no run has recorded the account at
+all. On a host without `BACKUP_S3_*` the card says off-host backup is not
+configured and stops there.
+
+The ledger starts empty on the release that adds it, so on a host that has
+been uploading nightly for months every account reads **no record yet** until
+the first run after the upgrade. That is the ledger having no history, not the
+bucket being empty — which is why it is a separate word from **never**, and
+why the row says so rather than claiming nothing has ever reached the bucket.
 
 Each verdict carries six hours of slack on top of the schedule's own 24, and
 that slack is load-bearing on two nights. The cron runs at 02:30 Europe/Berlin,