Don't switch active part if error in config upload

We were seeing that after a config upload and reboot, if the
migrations failed then the machine would stop booting.

The problem was that if the "config" migrations failed, then
we would unconditionally boot from the OTHER partition.  Doing
this when only a config upload was done doesn't make sense as
the other root partition is not even populated (because we didn't
do the firmware upload).

So instead of making the entire box into a brick, let's just
note that it's a config upgrade and not fail back.

Problem here is that if there was a config upload AND a firmware
upload we can be in some trouble.  To fix that we'll have to make
sure that once you do one you'll either have to clear the other
or perhaps just making the other one happen will clear the other.

This can likely by done by:
1) firmware update: rm /data/uploaded.db
2) config upload: make sure active partition matches current, if not, then
reset active to current.