Panic in transfer's unwrap of downstairs_buffer

In async fn transfer(..), this unwrap can panic:

                let responses = self.downstairs_buffer.remove(ds_id).unwrap();

If (I believe) we have three downstairs that have returned error (not skipped) none of them added
to the downstairs_buffer, and we get the unwrap() panic.

Update the code to better check for errors and if so, don't panic.

If at least one of the reads did succeed, and we should have a buffer, then we probably should
panic as that would mean something in crucible has lost the buffer and returning success to
the guest without giving them that buffer would be data corruption and we can't have that.

Start in async fn transfer(..) at the downstairs_buffer.remove(ds_id).unwrap() call and trace how downstairs read errors and successful reads reach it. The change is done when error-only reads avoid the panic, while a missing buffer after a successful read still preserves the stated data-integrity invariant.