It is no longer deterministic which Sybils we omit

It seems that each dir auth is voting for its favorite two relays, in the case of Sybils. The result is that none of them get listed in the consensus (as opposed to the "two of them" that our design says do).

I think the issue is in compare_routerinfo_by_ip_and_bw_().

Maybe it's here:

  node_first = node_get_by_id(first->cache_info.identity_digest);
  node_second = node_get_by_id(second->cache_info.identity_digest);
  first_is_running = node_first && node_first->is_running;
  second_is_running = node_second && node_second->is_running;

The "is_running" part here is suspicious -- if we cleared flags from some of them last time through the loop, does that change the order of picking them this time through the loop?

(Also, the comments for the function don't mention comparing identity digests as the last resort. They probably should.)