Story 5.4 — Implement infra upgrade detection and orchestration

**Epic:** #502 — Network Upgrade Workflow (Execute Phase)

**This story has been split into three** for clear sequencing and separate testability:

- **5.4a — Infra-upgrade detection** (read software_state, compare host/cluster, set `PendingInfraUpgrade`).
- **5.4b — Cluster rebuild via forked CLI** (hand off to epic #500's detached child; phase stays `PendingInfraUpgrade`). _Blocked on #500._
- **5.4c — Resume from `PendingInfraUpgrade`** (teach `listAndSeed` to resume after daemon restart; post-rebuild RBAC backoff). _Blocked on #500._

Child sub-issues: #707 (5.4a), #708 (5.4b), #709 (5.4c). This umbrella issue is retained for traceability; implementation happens in the three child stories.