Make build failures and handover robust

This pull request introduces the notion of container fate.

After a container is started, it may:

* Fail (due to a build or runtime failure)
* Be superceded by a subsequent container
* Become the live container

A select statement ensures that only one of these events is acted on,
preventing races to go live. Containers which are superceded before they went
live are torn down.

A container can go live and then be superceded, but it won't be torn down as
once it has started the only way it can be torn down is by 
`previousLive.Closing.Fall()`.

Fixes #3