failover for saga execution coordinator

[davepacheco]

As yet we have no design or implementation for taking over or resuming sagas when a Nexus instance become partitioned or otherwise offline for an extended period. That means a single failure could cause various rack activities to hang (provisions, upgrades, etc.). RFD 289 puts some constraints on this but doesn't say much else about it.

[davepacheco]

The current plan is:

• We wait for an operator to explicitly expunge a sled rather than doing any kind of automatic failover. (This is debatable, but as we say: get the human in the loop before we get them out of the loop. The expungement process will eventually ensure that the first Nexus is not running, which is critical for any kind of Steno takeover to be safe.)
• Once an operator expunges a sled, that will expunge its Nexus zones, and then nexus expungement: assign an old Nexus instance's sagas to another Nexus instance #5136 covers resuming sagas that were running on the expunged Nexus(es).