FatalOn and PanicOn should not be used for general-purpose errors, only must assertion failures. There is no functional reason why this is problematic, but it can lead to confusion about the distinction between assertions and error handling.

We should add a linter for this, enforcing that the argument must be a must function call.

Jira issue: CRDB-30036