Obc failsafe

This is a *WIP* PR to track progress in bringing up failsafe behavior according to the OBC rules (and also improving general failsafe behavior)

includes #1205
jep, as long as it is just a different behavior for the *same* failure (standard RTL, OBC: more complicated) i think it makes more sense to keep the interface between the commander and the navigator clean.