Re-do the fix for #3497 to ensure it works in all cases.
* If lineages are in an inconsistent (non-deployed) state, deploy them
* Test new _handle_identical_cert case
* Move lineage.has_pending_deployment() check up to _auth_from_domains
Less conceptually nice, but in the "renew" verb case it wasn't being called :(
* Swap _auth_from_domains return type
* It now matches _treat_as_renewal & _handle_identical_cert_request etc
* Revert "Move lineage.has_pending_deployment() check up to _auth_from_domains"
This reverts commit a7fe734d73.
* Move test back to handle_identical_cert_request
* We need to check for non-deployment on two separate code paths
- Once high up in "renew" (because failure to be deployed stops us from
divind down the stack)
- Once way down in _handle_identical_cert_request (because that's where it
makes the most sense for run / certonly)
- So refactor that work into storage.py
* We don't necessarily reinstall
