#31189 fix: bootstrap scoped identity on bound guests

Platform-created Cloud guests carry a root-owned legacy bound.json and install key even before normal enrollment writes identity.json. The scoped trigger identity path rejected that bound.json before it could create its separate scoped key, leaving the identity socket unavailable forever.

Keep bind-in-progress and already-enrolled legacy receipts fenced, while allowing the no-receipt platform bootstrap. The scoped key and receipt remain isolated and the legacy install key is unchanged; the regression test confirms the bound state no longer masks the scope read.

Validation: cargo test -p cmux-host identity::tests

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes scoped identity bootstrap on Cloud guests that carry a legacy bound.json and install key but no enrollment receipt, so the identity socket no longer stays unavailable.

• The scoped identity path now ignores a legacy bound.json when no receipt exists, allowing the separate scoped key to be created.
• Bind-in-progress and already-enrolled machines remain fenced off from this path, and the legacy install key is untouched.
• Adds a regression test confirming the bound state no longer masks the scope read and that an empty scope propagates its error without touching legacy or scoped state.