Some shard_role.cpp/.h invariants should be converted to tassert, because i) they are logically reachable if someone miuses the API, and ii) the situation is recoverable by failing the operation.

This is an example of such an invariant.