Tighten restore-at-install behavior

Harden the guarantee that if we're asked about a possible restore,
we always ALWAYS report back to the package manager.  This involved
closing "should never happen" edge cases around provisioning/auto-restore
setting that nevertheless were happening.

Also, on the auto-restore setting front, make sure to plumb that
system API through appropriately, since going behind its back and
manipulating the secure setting directly would cause things to get
out of step.

Bug 17060654

Change-Id: I52ca9c1ffbfc0bd6b57196157500d0868bfc2989