Safety at Scale: Aurora's Fault Management System