Add upgrade step to put the system identity back.

Forward port the 1.20 patch, with improvements.

The agent config is updated by the upgrade step.
The machine agent code that writes or removes the system identity is now moved into its own worker that runs after the upgrade steps have finished.  This avoids the race to remove and add the file.