Crash process on Sev40

A severity 40 is usually an error from which we can't recover. Because of this it is potentially dangerous to continue even if there was a Sev40.

We (Evan and I) discussed this and we think that by default we should crash a server process whenever it traces an event with a Sev40. There might be exceptions to that (potentially some `io_error`) that will need to be reviewed.

Start by locating where Sev40 events are traced and where the server process decides whether to continue. Review the proposed io_error exceptions and existing severity handling; done means Sev40 normally crashes the process, with any approved exceptions covered by tests.

Written by the indexing model from the issue text.