merge-shards --consume validates every shard first, moves the first
shard into the temporary output, and deletes each other shard once its
rows are durably committed. A failure keeps the partial product and
names the consumed shards and the resume command.