It turns out the callers of vm_page_replace know exactly which page they
are replacing and would like to assert about it. Change those from hard
panics to KASSERTs, and provide them with a wrapper so they don't have
to deal with warnings from an INVARIANTS-dependent dead store of the
return value of vm_page_replace.
Preliminary work for D4478.
I'm definitely open to suggestions for renaming the wrapper and
vm_page_replace if you have any ideas.