Actor's suspend / resume / pause workflows need to be clearly reentrancy safe

[zoez7]

The suspend / resume / pause workflow is getting really hard to reason about correctness. With multiple replicas of ate-apiserver, as well as ate-apiserver disruptions during upgrades, it's getting harder to reason about correctness and reentrancy. (i.e. What will happen if ate-apiserver crashed at different stages, and all possible status of worker and actor when ate-apiserver (or the user) retries the operation.

We need to restructure the workflows so humans can clearly understand and reason about correctness.

[HavenXia]

One more example from the #535 review, and a rough shape I'd propose. The conflict retry (state.Actor = fresh) is only correct because no step before AssignWorker modifies state.Actor in memory. To make the workflow sturctures more understandable to human, each step can explictly declare what it reads and writes. A step either persists what it changed, or doesn't change it.