create MergingRun through safe interface
Initialising a regular MergingRun even for OneShot merging avoid the
the need for directly creating completed MergingRuns and also re-uses
the existing code path to step and complete a Merge, which means there
is one less place to think about resource safety.
To be able to assert that the OneShot merge really completed, as well as
access the resulting run, we make expectCompleted not release the
MergingRun.
Similarly, we restore a completed MergingRun snapshot through a safe
interface. We also remove MergeKnownCompleted from the snapshot format,
which previously allowed to represent inconsistent states. It can
instead be re-constructed from the MergingRunState.
We also don't pass the TempRegistry across the module boundary any more.
The module can use its own where necessary.