Fix up the threading model (1/n)

1. add thread annotations
   - @WorkerThread: this method should run on the handler thread only
   - @AnyThread: this method is thread-safe
2. assert @WorkerThread methods really run on the handler thread
3. dispatch tasks to the handler thread where all state changes happen

TODO: remove locks in the next CL.

Bug: 158974169
Test: atest StagedRollbackTest
Change-Id: I64a5d494075daddc9a4b4fc330605987723f733d