Handle bad MCResponse error assertion

Before this could never happen.  Now it can't compile.
Limit the number of nmv retries to 2*node count

This doesn't actually fix the getbulk thing I was thinking of, but it is
a good idea in general to avoid looping on an unresolvable vb map
Centralize access to connection pools
Remove named error result from *Bucket.refresh

This does not add clarity
Atomically perform bucket refreshes

This should make things considerably less racy under failure.  Needs
more actual race testing with the race detector, though.

There are numerous caveats here since the bucket is still used both for
generating and parsing bucket descriptions on the wire *and* used to
represent a bucket within a running system.

The parts we expect to change may now do so freely.

cbugg: close bug-909 bug-903 bug-853