Major Description
Kudu data directories can be removed in between starts of a server, which will lead to tablet bootstrap failures. There exists logic to protect against this (see PathInstanceMetadataFile::CheckIntegrity()), but it was missing a key check to ensure that no directory had been removed from the set.
To be clear, we do want to support removing data directories, but in a more structured and protected manner. For the time being, we should close this loophole.