The current upgrade process requires a manual step to "finalize" the upgrade and set the cluster version. It's easy to forget this step, and we often can't enable new features until it has finished.

This manual step was motivated by the desire to preserve the option to downgrade, and the fact that if a node was down during the upgrade we couldn't tell if it might come back with the old version. Now that we do version checks at the beginning of all RPC connections, it should be safe to finalize the upgrade automatically, once all known nodes are running the new version

The auto-upgrade should be opt-out, so that operators who want to preserve the ability to downgrade can do so.