Prevents engine not stopping within 10 secs from being paired by another instance

We instead juts SKIP updating the policy, so
1. the MDM ticker will kick in 1 minute time,
2. find the policy misaligned,
3. enter the onMDMPolicyChange,
4. find the s.clientRunning == true
   (because it is set to false only in server cleanupConnection,
   and not by s.actCancel())
5. call s.actCancel() again if not nil
6. immediately return from <-s.clientGiveUpChan
7. finally call s.restartEngineForMDMLocked()

client/mdm/ticker.go

@@ -27,7 +27,7 @@ var policyLoader = LoadPolicy
 // goroutine; cancel the supplied context to stop.
 type Ticker struct {
 	interval time.Duration
-	onChange func(prev, curr *Policy)
+	onChange func(prev, curr *Policy) error
 	prev     *Policy
 }
 
@@ -39,7 +39,7 @@ type Ticker struct {
 // onChange when the policy actually changed since boot — without
 // this baseline the first tick would report every currently-managed
 // key as "added" and trigger a spurious engine restart.
-func NewTicker(reloadInterval time.Duration, onChange func(prev, curr *Policy)) *Ticker {
+func NewTicker(reloadInterval time.Duration, onChange func(prev, curr *Policy) error) *Ticker {
 	return &Ticker{
 		interval: reloadInterval,
 		onChange: onChange,
@@ -68,9 +68,13 @@ func (t *Ticker) Run(ctx context.Context) {
 			log.Infof("MDM policy changed: added=%v removed=%v changed=%v",
 				added, removed, changed)
 			prev := t.prev
-			t.prev = curr
+
 			if t.onChange != nil {
-				t.onChange(prev, curr)
+				if err := t.onChange(prev, curr); err != nil {
+					log.Errorf("MDM policy change handler failed (retrying in 1 minute): %v", err)
+					continue
+				}
+				t.prev = curr
 			}
 		}
 	}

client/mdm/ticker_test.go

@@ -34,11 +34,12 @@ func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
 
 	type change struct{ prev, curr *Policy }
 	changes := make(chan change, 1)
-	tk := NewTicker(testReloadInterval, func(prev, curr *Policy) {
+	tk := NewTicker(testReloadInterval, func(prev, curr *Policy) error {
 		select {
 		case changes <- change{prev, curr}:
 		default:
 		}
+		return nil
 	})
 	require.Equal(t, testReloadInterval, tk.interval)
 
@@ -70,11 +71,12 @@ func TestTicker_NoCallbackWhenPolicyUnchanged(t *testing.T) {
 	})
 
 	fired := make(chan struct{}, 1)
-	tk := NewTicker(testReloadInterval, func(_, _ *Policy) {
+	tk := NewTicker(testReloadInterval, func(_, _ *Policy) error {
 		select {
 		case fired <- struct{}{}:
 		default:
 		}
+		return nil
 	})
 
 	ctx, cancel := context.WithCancel(context.Background())