Fixing deep checking and shield checking

[rptb1]

Fixing false positive assertions found by deep checking so that deep checking is repaired as a useful too. See #208 .

Adding deep checking to CI so that we will find out promptly if it is broken again. See #208 .

Changing shield functions to take a shield, rather than an arena, so that the shield is naturally checked often. Fixes #205 .

Fixing #206 as described in the issue.

[rptb1]

#208 says:

1. branch/2016-04-16/trace-gens finishes the ring of generations but goes on to use the arena with an invalid trace.

Fixed in 0142213

[rptb1]

#208 says:

3. Deep checking has an infinite recursion in ArenaCheck via ShieldCheck, which checks some segments, which check their addresses via ChunkOfAddr, which checks the arena with ArenaCheck. I haven't discovered when this was introduced yet.

Fixed in 54b9351

[rptb1]

Changelist 191812 does not appear to fix job004026, as this assertion fires in many tests

mps/code/shield.c

Lines 88 to 90 in 179341b

	/* Every unsynced segment should be on the queue, because we have to
	remember to sync it before we return to the mutator. */
	CHECKL(shield->limit + shield->queuePending >= shield->unsynced);

The comment on that assertion is false. I think it used to be true, but various tweaks to the shield have rendered it ineffective.

Fixed in 0d56581 by keeping counts of the number of synced segments in the queue, and the number of unsynced segments not in the queue, allowing exact checking of the queue length.