storage: prevent startup after physical corruption

[jbowens]

Replication-level corruption results in crashing the node, but also the writing of a special file (base.PreventedStartupFile) to prevent node startup:

cockroach/pkg/kv/kvserver/replica_corruption.go

Lines 57 to 69 in df21930

	preventStartupMsg := fmt.Sprintf(`ATTENTION:
	this node is terminating because replica %s detected an inconsistent state.
	Please contact the CockroachDB support team. It is not necessarily safe
	to replace this node; cluster data may still be at risk of corruption.
	A file preventing this node from restarting was placed at:
	%s
	`, r, path)
	if err := fs.WriteFile(r.store.TODOEngine(), path, []byte(preventStartupMsg)); err != nil {
	log.Warningf(ctx, "%v", err)
	}

This is done because the node requires manual intervention. Today, corruption of physical media (eg, bit rot resulting in node-local data loss) similarly requires manual intervention to replace the node. Although we hope to support automatic recovery of physical corruption from other replicas some day (#67568), in the meantime we require the node with local corruption be decommissioned and replaced. We should consider writing base.PreventedStartupFile before crashing these nodes to prevent automatic restarting of a node that we have every expectation will crash again.

Jira issue: CRDB-28250

[nicktrav]

@RahulAggarwal1016 is going to pick this one up. Thanks, Rahul!