Move remote-upgrade's TO_SAVE into keep.d so that sysupgrade uses it too
Don't fail if any of the files to remove/save at upgrade don't exist