[occ] do not call iterateCheck when in ERROR

There is no point in asking the controlled task for a health check if it's still in ERROR.
The task can go to healthy state by requesting a recover transition, which gives a success or failure as a return value.

OCTRL-958

occ/occlib/OccServer.cxx

@@ -437,17 +437,19 @@ void OccServer::runChecker()
             }
         }
 
-        // execute periodic check, in any state
-        int err = m_rco->iterateCheck();
-        // if there's an error but the SM hasn't been moved to t_State::error yet
-        if (err && (m_rco->getState() != t_State::error)) {
-            updateState(t_State::error);
-
-            // the above publishes a state change event to the StateStream, but we also push an exception event on the
-            // EventStream because the transition was initiated by the task
-            auto taskErrorEvent = new pb::DeviceEvent;
-            taskErrorEvent->set_type(pb::TASK_INTERNAL_ERROR);
-            pushEvent(taskErrorEvent);
+        // execute periodic check, in any state except ERROR
+        if (m_rco->getState() != t_State::error) {
+            int err = m_rco->iterateCheck();
+            // if there's an error but the SM hasn't been moved to t_State::error yet
+            if (err) {
+                updateState(t_State::error);
+
+                // the above publishes a state change event to the StateStream, but we also push an exception event on the
+                // EventStream because the transition was initiated by the task
+                auto taskErrorEvent = new pb::DeviceEvent;
+                taskErrorEvent->set_type(pb::TASK_INTERNAL_ERROR);
+                pushEvent(taskErrorEvent);
+            }
         }
 
         m_mu.unlock();

occ/occlib/RuntimeControlledObject.h

@@ -268,12 +268,12 @@ class OCC_EXPORT RuntimeControlledObject {
     virtual int iterateRunning();
 
     /**
-     * Perform periodic checks during every state.
+     * Perform periodic checks during every state except ERROR.
      *
      * @return 0 if the check completed successfully and the machine can stay in the current state,
      *  or any other value to immediately trigger a transition to the error state.
      *
-     * This function is called continuously by OccServer::runChecker in any state, including
+     * This function is called continuously by OccServer::runChecker in any state except ERROR, including
      * t_State::running. Its purpose is for the implementer to report an unusual condition in
      * order to trigger a transition to t_State::error.
      */