persist: don't crash on undecodable rollup during usage scan

[DAlperin]

Motivation

The periodic storage-usage collection (storage_usage_fetch → StorageUsageClient::shards_usage_referenced) scans every live shard and decodes its rollups for billing. Rollup decoding expects the encoded state to be valid, so a single corrupt/undecodable rollup in any one shard panics the task — and since the scan runs in a spawned task under the abort-on-panic handler, that becomes a full process crash:

internal error: invalid encoded state: DecodeError { description: InvalidKey { key: 1781049768001 }, stack: [] }

This is a best-effort billing scan that touches every shard in the environment, so one bad shard should not be able to take down the whole process.

Description

Catch panics per shard inside shards_usage_referenced via ore_catch_unwind. On a panic we log the error, bump a new mz_persist_usage_referenced_shard_failures counter, and report that shard as zero usage while the remaining shards are computed normally. The "fail loudly" behavior on the actual data path is unchanged — only this periodic best-effort scan is made resilient.

Verification

New test usage_referenced_undecodable_rollup writes a shard, overwrites its rollup blob(s) with undecodable bytes, and asserts that shards_usage_referenced returns cleanly (reporting the shard as 0 bytes) and increments the failure counter, rather than panicking.