Hold dummy lock on `Locker.upgrade` failure.

If `Locker.upgrade` fails, then aquire a shared lock on the the dummy
page so that the descent continues to hold a lock on a single page.

This allows us to clean up a failed operation by calling unlock for the
`page` property of every `Descent` we have created, not having to check
to see if the `page` has been unlocked by a failed upgrade. The `page`
property of a `Descent` is always locked, so cleanup can always release
it.

Closes #296.