In tenant_migration_util.js, runTenantMigrationCommand with retryOnRetryableErrors=true will retry "not primary" errors on the donor. But Shard Merge isn't resilient to donor failover. Let's examine all retry logic in tenant_migration_util.js and tenant_migration_test.js and adapt it for Shard Merge.

This should make BFs easier to diagnose: e.g. if a Shard Merge fails because of donor failover, we want the test to fail right away and log a "not primary" error, instead of timing out after many minutes.