Introduce subcluster / vat upgrades

[rekmarks]

If a vat fails because its state is corrupted, the only conceivable recourse is to reinstall or "upgrade" the vat to handle the corrupted state. Currently, we only support reinstallation, and need to define and then introduce an "upgrade" operation. To be determined:

• What is the upgrade operand? The entire subcluster or just one of its vats?
• What happens to the identities of the subcluster, its vats, and their objects?
• What happens to durable promises?

This is a thorny subject that requires significant consideration.

[rekmarks]

This could be conceived as requiring or blocking #980. I hypothesize that it's better to introduce the notion of recovery paths and then proceed to upgrades.