governance: replace the halt counter with a halt_bit

[erwanor]

This is a ticket to replace the current halt counter with a bit flag that lives in nonverifiable storage, set by signal_halt and unset by running a migration.

Currently, every call to signal_halt must be matched with a manual counter increment in penumbra_app::TOTAL_HALT_COUNTER. The purpose of this mechanism is preventing unwanted node restarts, and progress following a halt signal. Operationally, this turned out to not be a tenable setup and @hdevalence suggested that we replace the counter with a single bit flag, eliminating the failure mode of running a binary with a TOTAL_HALT_COUNTER well ahead of the internal signal halt counter.

To do this, we need to:

1. Replace the halt_count state key with halt_bit with path: "governance/persistent_flags/halt_bit"
2. Replace the signal_halt implementation to set the halt_bit on (in nonverifiable storage)
3. Add a ready_to_start implementation to set the halt_bit off
4. Make is_chain_halted return the halt_bit
5. Make pd migrate check is_chain_halted and return early if it is, this should happen before any specific migration variant is called, later we can add an APP_VERSION check for each special case.
6. Add a --force flag to pd migrate so that we can optionally ignore the halt bit flag

The method names are suggestions, but they should all be documented so that their effect on application behavior can be understood.

[hdevalence]

This sounds like a great plan.

[conorsch]

Resolved via #4413.