design(onboard): define health-before-delete replacement

## Ownership

@cv owns this issue.

Do not start, assign, or submit this work unless @cv transfers ownership in this issue.

## Problem

Generic replacement can delete the active sandbox before the replacement proves runtime health.

A prebuilt context proves buildability and input identity. It does not prove replacement health or atomic rollback.

## Required design

Define:

- the identity and naming model for a staged replacement;
- health checks that must pass before deletion or route change;
- the swap boundary for registry, gateway, policy, and forwards;
- rollback behavior after each swap effect;
- OpenShell constraints that prevent a true atomic operation;
- operator-visible recovery when rollback cannot restore service.

## Change boundary

This issue owns design and validation planning first.

Do not implement replacement behavior until a maintainer accepts the design.

Do not mix this work with the FSM, entrypoint, desired-state, or receipt stacks.

## Security

The design must preserve sandbox isolation, policy containment, credential boundaries, and route ownership during staging and swap.

## Completion

An accepted design defines observable behavior, failure recovery, compatibility, and E2E evidence for implementation.