Implement real Decommissioner for consensus node decommission

## Summary

The `NoopDecommissioner` in `internal/daemon/consensus/decommission.go` is a stub that logs a message but takes no action. A real `Decommissioner` implementation needs to trigger the K8s decommission workflow for the old consensus node via the ConsensusCapsule API.

## Part of epic

Part of epic #499 — solo-provisioner-daemon Core

| SP | 5 |
|---|---|

## Acceptance criteria

- A concrete `KubeDecommissioner` (or similar name) implements the `Decommissioner` interface
- `Decommission(ctx, nodeID)` triggers the appropriate K8s operation on the ConsensusCapsule resource (e.g. sets a decommission annotation or deletes the resource — exact mechanism TBD with solo-operator team)
- Operation is idempotent (calling twice is safe)
- Errors are wrapped with `ErrSoakWatcher`
- Unit-tested with a fake K8s client
- `daemon.go` wired to use `KubeDecommissioner` instead of `NoopDecommissioner`

## Context

The `MigrationMonitor.run()` calls `mm.decommissioner.Decommission()` once all soak criteria are green and the fleet threshold flag file is present. Currently wired to `NoopDecommissioner` (implemented in story #520). The exact K8s decommission mechanism (annotation, CR field, deletion) needs to be confirmed with the solo-operator team.