upgrade: Add --skip-restart which preps but does not restart.

This adds a --skip-restart which makes `deployments/next` in a state
where it can be restarted into, but holds off on conducting that
restart.

This requires many of the same guarantees as `--skip-tornado`, in
terms of there being no Puppet or database schema changes between the
versions.  Enforce those with `--skip-restart`, and also broaden both
flags to prevent other, less common changes which nonetheless
potentially might affect the other deploy.

scripts/lib/upgrade-zulip-stage-2

@@ -81,6 +81,11 @@ restart_parser = start_arg_parser(action="restart", add_help=False)
 
 parser = argparse.ArgumentParser(parents=[restart_parser])
 parser.add_argument("deploy_path", metavar="deploy_path", help="Path to deployment directory")
+parser.add_argument(
+    "--skip-restart",
+    action="store_true",
+    help="Configure, but do not restart into, the new version; aborts if any system-wide changes would happen.",
+)
 parser.add_argument("--skip-puppet", action="store_true", help="Skip doing puppet/apt upgrades.")
 parser.add_argument("--skip-migrations", action="store_true", help="Skip doing migrations.")
 parser.add_argument(
@@ -104,18 +109,30 @@ parser.add_argument(
 )
 args = parser.parse_args()
 
-if args.skip_tornado:
+# There are two reasons we might want to do a "minimal change" which
+# asserts puppet/database are unchanged: if we're setting up for a
+# post-upgrade manual restart (--skip-restart), or if we're only
+# restarting part of the system (--skip-tornado).
+minimal_change = args.skip_restart or args.skip_tornado
+if args.skip_restart and args.skip_tornado:
+    logging.warning("Ignored --skip-tornado; all upgrades with --skip-restart skip all restarts.")
+    args.skip_tornado = False
+if minimal_change:
+    if args.skip_restart:
+        flagname = "--skip-restart"
+    else:
+        flagname = "--skip-tornado"
     if args.less_graceful:
-        logging.warning("Ignored --less-graceful; --skip-tornado is always graceful.")
+        logging.warning("Ignored --less-graceful; %s is always graceful.", flagname)
         args.less_graceful = False
     if args.skip_migrations:
         logging.warning(
-            "Ignored --skip-migrations; all upgrades with --skip-tornado assert no migrations."
+            "Ignored --skip-migrations; all upgrades with %s assert no migrations.", flagname
         )
         args.skip_migrations = False
     if args.skip_puppet:
         logging.warning(
-            "Ignored --skip-puppet; all upgrades with --skip-tornado assert no puppet changes."
+            "Ignored --skip-puppet; all upgrades with %s assert no puppet changes.", flagname
         )
         args.skip_puppet = False
 
@@ -139,7 +156,7 @@ if os.path.exists("/var/lib/rabbitmq/.erlang.cookie"):
         cookie_size = len(cookie_fh.readline())
 else:
     logging.info("No RabbitMQ erlang cookie found, not auditing RabbitMQ security.")
-if args.skip_puppet and rabbitmq_dist_listen:
+if (minimal_change or args.skip_puppet) and rabbitmq_dist_listen:
     logging.error(
         "RabbitMQ is publicly-accessible on %s; this is a security vulnerability!",
         ", ".join(rabbitmq_dist_listen),
@@ -164,7 +181,7 @@ if args.skip_puppet and rabbitmq_dist_listen:
 def shutdown_server() -> None:
     global IS_SERVER_UP
 
-    if args.skip_tornado:
+    if minimal_change:
         logging.info("Upgrade would require shutting down Zulip -- aborting!")
         sys.exit(1)
 
@@ -208,7 +225,7 @@ if glob.glob("/usr/share/postgresql/*/extension/tsearch_extras.control"):
     )
     subprocess.check_call(["apt-get", "remove", "-y", "postgresql-*-tsearch-extras"])
 
-if not args.skip_puppet:
+if not (minimal_change or args.skip_puppet):
     logging.info("Upgrading system packages...")
     subprocess.check_call(["apt-get", "update"])
     subprocess.check_call(["apt-get", "-y", "upgrade"])
@@ -261,6 +278,9 @@ class_renames = {
 classes = re.split(r"\s*,\s*", get_config(config_file, "machine", "puppet_classes"))
 new_classes = [class_renames.get(c, c) for c in classes if c != "zulip::base"]
 if classes != new_classes:
+    if minimal_change:
+        logging.error("Would need to adjust puppet classes -- aborting!")
+        sys.exit(1)
     logging.info("Adjusting Puppet classes for renames...")
     subprocess.check_call(
         [
@@ -282,6 +302,9 @@ if os.path.exists(emoji_path):
         emoji_data = f.read()
     emoji_sha = hashlib.sha1(emoji_data).hexdigest()
     if emoji_sha == "47033121dc20b376e0f86f4916969872ad22a293":
+        if minimal_change:
+            logging.error("Would need to delete images-google-64 -- aborting!")
+            sys.exit(1)
         shutil.rmtree("/home/zulip/prod-static/generated/emoji/images-google-64")
 
 # And then, building/installing the static assets.
@@ -353,7 +376,7 @@ elif not args.skip_migrations:
         if line_str.startswith("[ ]"):
             migrations_needed = True
 
-if args.skip_tornado and migrations_needed:
+if minimal_change and migrations_needed:
     logging.error("Would need to apply migrations -- aborting!")
     sys.exit(1)
 
@@ -380,16 +403,20 @@ if not args.skip_puppet and IS_SERVER_UP:
         ["./scripts/zulip-puppet-apply", "--noop", "--force"], stdout=subprocess.DEVNULL
     )
     if try_puppet.returncode == 0:
-        if args.skip_tornado:
+        if minimal_change:
             logging.info("Verified no Puppet changes are necessary.")
         else:
             logging.info("No puppet changes found, skipping!")
         args.skip_puppet = True
         has_puppet_changes = False
-    elif args.skip_tornado:
+    elif minimal_change:
         logging.error("Would need to apply puppet changes -- aborting!")
         sys.exit(1)
 
+
+if args.skip_restart:
+    logging.info("Successfully configured in %s!", deploy_path)
+else:
     # NOTE: Here begins the most likely critical period, where we may be
     # shutting down the server; we should strive to minimize the number of
     # steps that happen between here and the "Restarting Zulip" line