fix(board-roll): reject >1 marker pair instead of spanning across zones

rev0 (PR #868, Gitea comment #18505) caught a real data-relocation bug:
the marker scan locked start_idx to the FIRST START but overwrote end_idx
on EVERY END, so a board with two BOARD-ROLL zones collapsed into one
first-START..last-END span. That span engulfed the curated `##` content
and the intermediate START/END markers between the two zones, silently
relocating pinned lines into the LEDGER — the exact failure this tool
exists to prevent.

Fix (conservative, matches the "no markers = exit 3" posture): count
START and END markers; if either appears more than once, refuse with
exit 3 and change nothing. Single-zone behavior is unchanged.

Adds regression group 8: two zones with a curated CANARY section between
them, cap 80 → asserts exit 3, LIVE unchanged, and the canary never
leaks into the LEDGER. shellcheck -S warning clean; 8/8 groups pass.

Refs #868

packages/mosaic/framework/tools/orchestrator/README.md

@@ -68,10 +68,15 @@ board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
   -h, --help         show help and exit 0
 ```
 
+Only **one** roll zone is supported. If a board carries more than one
+`BOARD-ROLL:START`/`END` pair, `board-roll.sh` refuses (exit `3`, zero changes)
+rather than span first-START..last-END and relocate the curated content between
+the zones — consolidate the ticks into a single zone instead.
+
 Exit codes: `0` LIVE under cap (already, or after rolling) — on `--dry-run`, a
 plan exists or nothing to do · `2` usage / argument / IO error · `3` cannot meet
-the cap (no markers, or the pinned sections alone exceed the cap and need a manual
-trim).
+the cap (no markers, **more than one marker pair**, or the pinned sections alone
+exceed the cap and need a manual trim).
 
 Writes are atomic (temp file + `mv`, LEDGER first) so a failure never leaves a
 board half-written; line endings are normalized to LF on rewrite. `--dry-run`