Postmaster's handing of startup-process crash is busted

My Salesforce colleagues observed a failure mode in which a bug in the
crash recovery logic caused the startup process to get a SEGV while trying
to recover after a backend crash. The postmaster should have given up at
that point, but instead it kept on respawning the startup process, which
of course just kept on crashing. The cause seems to be a bug in my old
commit 442231d7f71764b8: if FatalError has been set, we suppose that the
startup process died because we SIGQUIT'd it, which is simply wrong in
this case.

AFAICS the only way to fix this properly is to explicitly track whether we
sent the startup process a kill signal. I started out with a separate
boolean, but after awhile decided that it'd be better to invent an enum
representing the startup process state, which could also subsume the
existing but rather ad-hoc flag RecoveryError. So that led me to the
attached patch.

Any thoughts/objections?

regards, tom lane