fix(state): If a format change is cancelled, also cancel the format check, and don't mark the database as upgraded

[teor2345]

Motivation

Zebra can keep running the post-upgrade code when a format upgrade is cancelled.

If the format check is exhaustive, this can cause a panic on shutdown.

If some data is not covered by the format check, it can either:

• cause a panic on shutdown, or
• incorrectly mark the database as upgraded.

Specifications

don't panic

Complex Code or Requirements

This is a race condition, so it only happens sometimes, and it depends on other activity within Zebra, and on the machine it's running on.

Solution

• Return an error when an upgrade is cancelled
• When an upgrade is cancelled, skip the upgrade check, and marking the database as upgraded
• Move an upgrade log to the correct location

Review

This fix needs to be part of the 1.2.0 release, it is urgent.

Reviewer Checklist

• Will the PR name make sense to users?
  • Does it need extra CHANGELOG info? (new features, breaking changes, large changes)
• Are the PR labels correct?
• Does the code do what the ticket and PR says?
  • Does it change concurrent code, unsafe code, or consensus rules?
• How do you know it works? Does it have tests?

[oxarbitrage]

Looks good, thanks!