recovery is impossible if more than `f` nodes fail at once

[evanmcc]

This is a protocol problem, at least when we're running in diskless mode (which will be the default, I imagine). In the end, this will likely require FSMs that require this sort of durability to implement from-disk recovery on their own, but we should provide tools to make this easier or a simple default implementation.

[evanmcc]

ideas:

• admin state dump, corresponding enhancement of the start command to take an initial state, so an admin can grab the state of the last nodes, declare it canonical and inject it into a new quorum.
• allow behaviors to declare themselves as having persistent state, which should allow recovery from crashes if not node loss.