operator: hostNetwork Deployments can hit a brief zero-available window on rollout

The hostNetwork `unbounded-net-controller` and `metalman` Deployments use RollingUpdate with `maxSurge: 0` because the old and new pods would otherwise bind the same host ports. As a result the old pod terminates before the new one starts, so a broken new image causes a brief window where `AvailableReplicas == 0`.

Follow-up / operational hardening:
- Roll back on failed rollout.
- Alert on `AvailableReplicas == 0` for these Deployments.
- Consider rollout guardrails (e.g. readiness gating, progressDeadlineSeconds tuning) to bound the window.

Context: split out of the umbrella `unbounded-system` integration PR #388.

Start with the hostNetwork Deployment definitions for unbounded-net-controller and metalman, then inspect how rollouts and operational alerts are configured. Define the failure and recovery behavior for a broken image, including rollback and AvailableReplicas == 0 alerting. Done means the rollout window is bounded and both Deployments have the agreed safeguards.

Written by the indexing model from the issue text.