T1771: enable "reboot-on-upgrade-failure" for new VyOS installations

[c-po]

Change summary

If any part of the system boot fails, we now set overall_status=1 in the vyos-router startup script. When an error during the image upgrade is detected, the system will automatically revert the default boot image to the previously used version.

The user is informed via console messages:

Booting failed, reverting to previous image
Automatic reboot in 5 minutes
Use "reboot cancel" to cancel

The user has 5 minutes to log in and run reboot cancel to remain in the faulty image for troubleshooting.

Once the system boots into the previous image, the MOTD will display a persistent warning message - cleared during next reboot.

WARNING: Image update to "VyOS 1.5.xxxx" failed
Please check the logs:
/usr/lib/live/mount/persistence/boot/NAME/rw/var/log
Message is cleared on next reboot!

Upgrade failure can be synthetically injected by booting with Kernel command line option: vyos-fail-migration

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T1771

Related PR(s)

• T1771: automatic reboot of system into previous image vyos-1x#4501
• T1771: automatic reboot of system into previous image vyos-documentation#1635

How to test / Smoketest result

You can boot the new image using: vyos-fail-migration Kernel cmdline parameter to trigger this.

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[sever-sever]

Boot the previous image if an upgrade fails

[dmbaturin]

The timeout seems sensible to allow the user to examine the system and take action manually. I also agree with the idea to enable it for new installations via the default config but make it possible to disable by removing the option.