fix: [nomad-step-1] S1.3 — restore --empty guard + drop hardcoded deploy --dry-run (#842)

Picks up from abandoned PR #859 (branch fix/issue-842 @ 6408023). Two
bugs in the prior art:

1. The `--empty is only valid with --backend=nomad` guard was removed
   when the `--with`/mutually-exclusive guards were added. This regressed
   test #6 in tests/disinto-init-nomad.bats:102 — `disinto init
   --backend=docker --empty --dry-run` was exiting 0 instead of failing.
   Restored alongside the new guards.

2. `_disinto_init_nomad` unconditionally appended `--dry-run` to the
   real-run deploy_cmd, so even `disinto init --backend=nomad --with
   forgejo` (no --dry-run) would only echo the deploy plan instead of
   actually running nomad job run. That violates the issue's acceptance
   criteria ("Forgejo job deploys", "curl http://localhost:3000/api/v1/version
   returns 200"). Removed.

All 17 tests in tests/disinto-init-nomad.bats now pass; shellcheck clean.

bin/disinto

@@ -762,7 +762,6 @@ _disinto_init_nomad() {
       fi
       deploy_cmd+=("$svc")
     done
-    deploy_cmd+=("--dry-run")  # deploy.sh supports --dry-run
 
     if [ "$(id -u)" -eq 0 ]; then
       "${deploy_cmd[@]}" || exit $?
@@ -840,6 +839,14 @@ disinto_init() {
     exit 1
   fi
 
+  # --empty is nomad-only today (the docker path has no concept of an
+  # "empty cluster"). Reject explicitly rather than letting it silently
+  # do nothing on --backend=docker.
+  if [ "$empty" = true ] && [ "$backend" != "nomad" ]; then
+    echo "Error: --empty is only valid with --backend=nomad" >&2
+    exit 1
+  fi
+
   # --with requires --backend=nomad
   if [ -n "$with_services" ] && [ "$backend" != "nomad" ]; then
     echo "Error: --with requires --backend=nomad" >&2