Fix race with concurrent merges and deletes

This fix is a remake of Scott Fritchie's slf-tombstone-management
branch. It builds on heavy cleanup of the get functions that created a
lot of edges cases the branch worked around, as well as the introduction
of epochs by Evan that fixed problems with folds not viewing a stable
snapshot after the multifold support was added, as there were edge cases
around the use of timestamps.  The retry code in delete was refactored
into the put method, and the tombstone2 was removed as it could not
solve the merge/delete race by itself while creating incompatible data
files.

* A delete in the writer process may race with a merge writing a value
  for the same key on a file with id greater than the current write file.
  Re-opening the cask would end up loading the merged value and forgetting
  the delete. The delete path will now detect the race and retry the
  tombstone write on a file with id greater than the merge file until it
  prevails.
* A partial merge could end up removing the tombstone for a key that
  still has a value in one of the unmerged files. tombstones just can not
  be dropped during a partial merge without knowing that all previous
  versions have disappeared too, so we avoid it. This may create more
  garbage on disk than previous versions, but it's safer. We should have a
  way to force a full merge.
  kind of tombstone that contains a pointer to the value it is replacing
  has been added.
* Change order of scan & fold: now oldest -> youngest.
* Add un-write last used when writing to a file and then finding a
  conflict when updating the keydir. The write is tried at a higher file
  and the old write is undone. Used in the merge/delete race fix.
* Avoid getting time in C land, passing it from Erlang instead. Now time
  in tests can be completely faked.
* Adjust command frequency weightings for PULSE model to find problems
  like this merge/delete race.
* Avoid storing tombstones in the keydir when possible. For this,
  hintfile records store a flag in the offset field to indicate value is
  a tombstone.
* For testing purposes, fold() and fold_keys() are extended with
  another argument to expose the presence of keydir tombstones.
* And add option to make those compiler errors
Fix merge not correcting race on tombstone write

If a merge writes a tombstone, it needs to detect whether a new value
was put for that key at the same time and avoid that tombstone
overriding it on disk.

As part of this, removing use of merge start time or epoch. Merge logic
should see latest entries in the keydir. I'm not sure why it bothered
checking timestamps on files and the merge timestamp. I imagine that was
able to hide a pulse failure in the past, but does not seem correct.
Fix PULSE shrinking control

From Ulf Norell:

    One reason you might have some problem with shrinking (but which should be
    unrelated to the issue at hand) is this code:

      P = ?FORALL(...),
      ?SHRINK(P, [?ALWAYS(3, P)]).

    When you wrap ?ALWAYS on the outside you'll get a fresh command sequence
    for each repetition, so what will (most likely) happen in this case is that
    the shrinking step from P to ?ALWAYS(3, P) fails and shrinking proceeds
    just with P. The right way to do this is to use the shrinking parameter:

      ?FORALL(Cmds, commands(?MODULE),
      ?LET(Shrinking, parameter(shrinking, false),
      ?ALWAYS(if Shrinking -> 3; true -> 1 end,
      ?FORALL(Seed, pulse:seed(),
        ...
      )))).

    Note how the ?ALWAYS is placed between the command generator and the seed
    generator. That way each repetition will use the same command sequence but
    a different seed.
Change RPC timeout to 45 minutes, stop (I hope?) shrinking on RPC timeout
Merge pull request #148 from basho/bugfix/delete-merge-race

Fix race with concurrent merges and deletes