Monitor nodes after they upgrade

...in loaded_upgrade to detect unexpected crashes.

If a node crashes some time after the upgrade (one cause can be merge_index corruption), loaded_upgrade carries on without noticing and never proceeds to upgrade the next node.