From the design, add test coverage that the TenantMigrationDonor retries all of its steps (sending a remote message, updating its state document) if its OperationContext is interrupted by killOp.