panic causes stacks to unwind and defers to be invoked (possibly releasing locks) until eventually something either handles the panic (unlikely) or we reach the runtime and it kills the process. While the process is dying, other goroutines are still running which may encounter invalid states due to the panic. For fatal errors we should use log.Fatal{,f} instead which will kill the process before any locks are released.

I'm not sure if a massive search-and-replace is warranted, but some key packages such as storage deserve attention.

See #16460 for motivation.