update process could have less impact on fault tolerance

RFD 565 says that when possible, for most control plane zones, we'll add new instances of components before expunging old ones. That's because it ensures that during an upgrade, we never have less redundancy in those components than during normal operation. But what we've implemented is expunge-then-add, which means that during an upgrade, we briefly eat up one of the failures that the system is expected to survive. This isn't a big deal and we don't have plans to change this soon.

If we do decide to switch the current expunge-then-add behavior to add-then-expunge, we will also need the system to ensure it always has the resources required for the extra deployment. This is discussed in detail in #8511. (I'm closing that now because it's not a problem unless we implement the add-then-expunge approach covered in this issue.)

Start with RFD 565 and the current expunge-then-add update path; use #8511 for the resource-availability requirements. Done means upgrades add new component instances before expunging old ones while ensuring resources for the extra deployment.