Kill instances based on EC2, not Hobson.

If we depend on Hobson for running "truth" we end up leaking instances
every time Hobson loses track of a machine. It's better to trust EC2 to know
what stuff is running our code when it comes to turning off those instances
(as opposed to trusting Hobson for software-level state knowledge).
Keep track of the instances we just created rather than re-querying things.
Try a little harder to tag and terminate.

We don't want to barf entirely when an operation fails, so we are carefully
catching some known conditions and doing an operation at a time. This means
we won't leak instances as badly if the API falls behind or the like.

Previously, the batch operations were efficient, but if one instance object
was borked, the whole "shutdown the things" call would fall in one shot, doing
absolutely nothing.