How many downstairs have to return OK for snapshots?

In https://github.com/oxidecomputer/crucible/pull/407, I said:

Whether or not a Flush has SnapshotDetails set, It looks like the Upstairs will be ok with two out of three flushes returning OK. I think this has to change: if SnapshotDetails is set, then all three downstairs have to report OK for that Flush for it to be considered OK and acked.

Then Alan said:

To throw some more gas on this fire, If we require all three downstairs to answer before we can take a snapshot, it will essentially prevent taking a snapshot where one downstairs is broken. I think there are other situations (like deactivate) where this issue is already present.

This issue tracks the work of answering the title question: how many downstairs have to return OK for a snapshot to be considered OK?

Start by reviewing pull request 407 and the discussion about Flush, SnapshotDetails, Upstairs, and downstairs responses. Trace how snapshot success and acknowledgement are currently determined, then resolve the two-versus-three-OK policy, including the case where one downstairs is broken. Done means the chosen behavior is documented and covered for the relevant success and failure cases.