Unsafe to run nodetool cleanup during bootstrap or decommission

What we expected: Running a cleanup is a safe operation; the result of running a query after a cleanup should be the same as the result of running a query before a cleanup.

What actually happened: We ran a cleanup during a decommission. All the streamed data was silently deleted, the bootstrap did not fail, the cluster's data after the decommission was very different to the state before.

Why: Cleanups do not take into account pending ranges and so the cleanup thought that all the data that had just been streamed was redundant and so deleted it. We think that this is symmetric with bootstraps, though have not verified.

Not sure if this is technically a bug but it was very surprising (and seemingly undocumented) behaviour.