“But a crew was never told where its missile was aimed. That sort of knowledge might inspire doubt. Like four members of a firing squad whose rifles were loaded with three bullets and one blank, a missile crew was expected to obey the order to fire, without bearing personal responsibility for the result.”