Read only parents can't do LiveRepair

[leftwo]

If a read only parent upstairs builds up too many jobs, the upstairs will fault it and kick it out.
This too many jobs can come from either too much actual work, or if the upstairs loses a
connection to the downstairs and the job threshold gets too high.

Once a downstairs is faulted, the only way back in is through LiveRepair. But, we can't
LiveRepair a Read Only downstairs.

I reproduced this by creating a disk from a snapshot, then pstop`ing one of the downstairs
for the read only parent. After enough jobs built up, it kicked out the pstopped downstairs
prun'ing that downstairs brought it back, and setup the failure.

[leftwo]

As a bonus, this will also prevent the instance from stopping.

[leftwo]

https://github.com/oxidecomputer/customer-support/issues/44

[leftwo]

A couple of ideas here.

Maybe the upstairs, if it's a ROP, will allow back in a downstairs without it having to LiveRepair?

Maybe allow ReadOnly downstairs to do the Open/Close/NoOp repair comands, and only really
block an actual Repair command? That repair command is the one that actually could change things,
the other commands don't change anything.

[leftwo]

Done!

[leftwo]

Actually, wait, let's not close this yet.

We do need a solution for how to replace a read only parent. The current solution will allow back the
same downstairs that was kicked out, but we need another solution when we have a disk or sled that
goes away that holds read only regions and a way to replace one of those.