Blueprint planner safety: Consider zones present in inventory that are not in the blueprint

When deciding whether to upgrade zones, the planner considers whether previous upgrades have completed by confirming that the new zone config has appeared in inventory. (This can either mean a new zone has been successfully started, if the upgrade was an expunge+replace, or that the zone has successfully restarted, if the upgrade was in-place.) We should also consider zones that are present in inventory but are expunged in the blueprint.

None of this applies to upgrade-in-place zones, since there is no expungement involved.

A zone present in inventory but expunged in the parent blueprint means either the parent blueprint has not yet been executed, so the zone is still running, or it has been executed but zone shutdown failed. In the "blueprint has not been executed" case, we also won't see the new zone that's supposed to replace it, so we're okay. But in the "zone shutdown failed" case, we may be in trouble, because the old zone is still running. This could affect at least:

• Shared resource usage (e.g., external IPs) - the planner treats the blueprint as the source of truth, so it may reassign an external IP to a new zone even if the old zone is still running. This may be fine? But I don't think we've really tested it much.
• API versioning - we wait to upgrade Nexus until all other zone types have been upgraded to avoid API compatibility issues. If an old zone is still running, should we wait to upgrade Nexus until we can get rid of it?

We could also have expunged a zone for non-upgrade reasons. In practice we only do that for sled removal (not an issue, since the sled is gone) or disk expungement (maybe not an issue? unless the zone could still be running even if the disk has disappeared out from under it?), but in dev / support operations we can expunge zones by hand, so should still consider these too.

Start by tracing the blueprint planner's existing inventory check for completed zone upgrades and how it distinguishes upgrade-in-place zones. Follow the inventory and blueprint zone sets, including expunged zones, and review the handling of failed shutdowns. Done means planner decisions account for still-present expunged zones without changing upgrade-in-place behavior, with coverage for the described cases.