use nova-conductor instead of direct db access

Passes unit tests and has been very heavily tested with bless & launch
on a vanilla setup (qcow2, use_image_service=False). Other paths need
to be vetted: lvm, migration.

Had to make less rich use of the disable_terminate column in the
instances table since conductor doesn't let you modify it in
instance_update. So I just set-it-and-forget-it on bless. If bless
fails and puts the instance in an ERROR state, then the user still has
to discard/live-image-delete.

Change-Id: I318a06de19a12d06ce685b1d4c6bef1c6567785a