Right now the TenantMigrationAccessBlocker is removed by the OpObserver when the expireAt field is set. This doesn't align with the design. It should be removed when the donor's state document is removed.

Also, this is causing an issue if the donor restarts. If expireAt is set prior to shutdown but the TTL does not get to remove the donor's state doc before that, then on restart the TenantMigrationAccessBlocker would get recovered but never removed.