dev/core#1460 - Apply different dispatch policies during main and finish phases

dev/core#1460 - Apply different dispatch policies during main and finish phases

This is the culmination of the preceding commits: when running upgrades,
we don't just apply one brittle whitelist throughtout the process. Instead:

- Apply a very restrictive dispatch policy while executing incremental DB updates,
  preventing interference from unexpected callpaths.
- Apply a very permissive dispatch policy while executing the final cleanup/reset,
  allowing more data-structures to rehydrate correctly.