Cardano Updates

So the snapshot code doesn't have to poke at the representation
directly.

They should equal the merge debt. This should enable a full round trip
of all the table handle structure and metadata including merge credits,
including in the case of preserving known credits of completed merges.

This is not currently tested, but it ought to be.

We can specify a deposit relative to the existing balance, or specify a
target new absolute balance. The latter will be useful once we do
scaling from nominal ro physical credits.

Also update comments about credits and the prototype (now that the
prototype got updated).

This property runs a sequence of state machine actions where the last action
definitely injects errors, at which point we can check if no errors are
swallowed. See the documentation of `prop_noSwallowedExceptions` for more
information. The property is currently expected to fail.

If injected errors left the database in an inconsistent state, then property
cleanup might throw exceptions. In the "swallow error" tests that will be added
in the next commits, this inconsistent state is allowed, leading to exceptions,
but we do not want these exceptions to cause the property to fail. The
'CheckCleanup' flag makes it configurable to ignore these exceptions.

When we start testing that errors are not swallowed by `lsm-tree`, we'll be
injecting errors into bits of code that are not exception safe (yet). As a
result, the file system and reference checks would lead to property failures.
However, we just want to test that errors are not swallowed, so we make these
checks configurable. File system checks and reference checks can
enabled/disabled independently.

Instead of adding `Maybe Errors` to each constructor, which would probably lead
to quite a bit of duplicated code, I opted to add a single top-level constructor
that contains a `Maybe Errors` and an `Action'`. This `Action'` is a new data
type that contains the interesting constructors, like `New` and `Updates`.

As a result of this change, there quite a few mechanical changes, but not much
of it is interesting. However, having made this change, we are now ready to
enable fault injection for all the actions whenever we want to.

In particular, change MergingRun from storing NumEntries to storing
MergeDebt, and use this in constructors and snapshot functions.

This also changes the snapshot representation to use MergeDebt instead
of NumEntries.

feat(issue558): test silent snapshot corruption

In addition to minor changes, this commit makes the following changes:

- Add classification of snapshot corruption exceptions in tests.
- Fix snapshot corruption to be hardlink safe.
- Clamp choice of bit-to-corrupt to avoid overflow.
- Add more specific tagging in statemachine tests.