chore: ensure no subnet message execution on canister aborted in install code

[mraszyk]

This PR hardens the scheduler implementation by ensuring that no subnet messages are executed on a canister aborted in install code. This prevents out-of-order subnet message execution since, e.g., a canister_status enqueued after install_code could return before install_code if canister_status quickly completes while the canister is aborted processing install_code. Currently, out-of-order subnet message execution is not possible because there could only be a single aborted install code execution and it is resumed (in advance_long_running_install_code) before other subnet messages are executed (in drain_subnet_queues), but relying on that assumption is quite fragile.

The new test from this PR would fail if the code from this PR hardening the scheduler is omitted and drain_subnet_queues is executed before advance_long_running_install_code:

diff --git a/rs/execution_environment/src/scheduler.rs b/rs/execution_environment/src/scheduler.rs
index d63de5041f9..9cc7d555046 100644
--- a/rs/execution_environment/src/scheduler.rs
+++ b/rs/execution_environment/src/scheduler.rs
@@ -466,6 +466,35 @@ impl SchedulerImpl {
                 scheduler_round_limits.update_subnet_round_limits(&subnet_round_limits);
             }
 
+            // Subnet queues: execute long running install code call if present.
+            {
+                let measurement_scope = MeasurementScope::nested(
+                    &self.metrics.round_advance_long_install_code,
+                    &root_measurement_scope,
+                );
+                let long_running_canister_ids = state
+                    .canister_states()
+                    .iter()
+                    .filter_map(|(&canister_id, canister)| match canister.next_execution() {
+                        NextExecution::None | NextExecution::StartNew => None,
+                        NextExecution::ContinueLong | NextExecution::ContinueInstallCode => {
+                            Some(canister_id)
+                        }
+                    })
+                    .collect();
+
+                let mut subnet_round_limits = scheduler_round_limits.subnet_round_limits();
+                state = self.advance_long_running_install_code(
+                    state,
+                    &mut subnet_round_limits,
+                    &long_running_canister_ids,
+                    &measurement_scope,
+                    registry_settings.subnet_size,
+                );
+
+                scheduler_round_limits.update_subnet_round_limits(&subnet_round_limits);
+            };
+
             let mut round_limits = scheduler_round_limits.canister_round_limits();
             if round_limits.instructions_reached() {
                 self.metrics
@@ -1451,25 +1480,6 @@ impl Scheduler for SchedulerImpl {
             scheduler_round_limits.update_subnet_round_limits(&subnet_round_limits);
         }
 
-        // Subnet queues: execute long running install code call if present.
-        {
-            let measurement_scope = MeasurementScope::nested(
-                &self.metrics.round_advance_long_install_code,
-                &root_measurement_scope,
-            );
-
-            let mut subnet_round_limits = scheduler_round_limits.subnet_round_limits();
-            state = self.advance_long_running_install_code(
-                state,
-                &mut subnet_round_limits,
-                &long_running_canister_ids,
-                &measurement_scope,
-                registry_settings.subnet_size,
-            );
-
-            scheduler_round_limits.update_subnet_round_limits(&subnet_round_limits);
-        };
-
         // Scheduling.
         let round_schedule = {
             let _timer = self.metrics.round_scheduling_duration.start_timer();
@@ -1983,11 +1993,7 @@ fn can_execute_subnet_msg(
                 // Note, this does NOT include aborted executions.
                 return false;
             }
-            Some(ExecutionTask::AbortedInstallCode { .. }) => {
-                // If there is an aborted install code in progress, we can't execute the subnet message.
-                // This is to prevent out-of-order subnet message execution.
-                return false;
-            }
+            Some(ExecutionTask::AbortedInstallCode { .. }) => true,
         };
 
     // Some heavy methods use round instructions.