failover: only start instance if we should

gnt-instance failover on an instance marked as down will mistakenly bring it
up. The watcher will then shut it down again, but it's a lot better (and safer)
not to start it at all.

Reviewed-by: imsnah