Restore the DUT through cleanup, and let a procedure end early

[jadamcrain]

Item 2 of #59. Stacked on #60, so this PR's base is #60's branch. Once #60 merges, I'll rebase onto main.

Bug fixed. Several procedures restored the DUT in their last step. That step never ran when an earlier one failed, so later procedures in a -run all found the DUT still changed:

• 2.7's configurable-device input procedures (8.13.2.3, 8.16.1.2.3 and 8.21.2.2) and output procedures left points uninstalled.
• 6.6.3 left link layer confirms on.
• 3.1r1's 8.21.1 left the double-bit inputs disabled.

They now restore in the procedure's cleanup, which the runner runs however the procedure ends.

One mechanism for restoring the DUT

• Steps and cleanup built together. ProcedureDefinition.plan returns both, so the cleanup can see what the steps changed. Ordinary definitions still override steps, which now has a default that throws, so they gained an override modifier.
• Undoable. It arms its undo just before the change runs. The undo then runs once, and only if the change ran.
• Hand-written wrappers replaced. The restore-on-failure wrappers in PointRanges, StaticVariations, AssignClass and OutputEvents now use cleanup. Restores that a procedure publishes as steps stay where the procedure has them: 8.23 x.1's "points are back" step and 8.26.2's step 46.

Ending early. A step throws EndProcedure when the DUT answers as a level 1 or 2 device may. The runner then skips the remaining steps and runs the deferred checks and the cleanup. It's a ControlThrowable, so Try doesn't catch it. This replaces the skipped flags in StaticVariations, EventVariations and AssignClass.

Configuration checks. Each definition can now report the configuration problems that stop it from running (configurationProblems), and a run collects them from the procedures it will run, removing duplicates.

• These replace the network, multi-drop, collision avoidance and event-rule checks that were registered by hand in Revision. Checks that apply to the whole revision stay central, in EventRules.
• They now apply only to procedures that will run.
• 8.26.3's class-count check no longer depends on the device supporting all three classes, since the procedure runs either way.

requiring and Requirement.all

• ProcedureDefinition.requiring replaces StaticInputs.Requiring, which dropped the inner procedure's cleanup and didn't list its extra condition.
• Requirement.all flattens nested alls.

Testing

• 2.7's -describe output is byte-identical across 227 procedures and three configurations.
• 3.1r1's describe output changes only as intended: extra conditions are listed, cleanup steps are shown, and one requirement line is flatter.
• The new CleanupTest covers ending early, Undoable, a restore after a failure at each bug site, requiring, and the run's configuration checks. AssignClassTest covers the class counts.