Pool image/version rollout: rolling replacement of warm VMs

When a pool's underlying flintlock image/kernel spec changes, add a rolling-replacement strategy that swaps out existing warm VMs for ones built from the new spec without dropping pool availability. Fits into the existing per-pool reconciler/replenishment strategy.

Start with the existing per-pool reconciler and replenishment strategy mentioned in the issue, tracing how warm VMs are selected and created from the flintlock image/kernel spec. Define the rollout behavior so existing VMs are replaced with ones using the new spec while pool availability is maintained.

Written by the indexing model from the issue text.