Pre-severance checks

Parent: #208

Summary

Before severing, run pre-flight checks to verify the workload and control room are in a good state. Catch obvious problems before any changes are made.

Requirements

• Verify workload target exists and is not itself a control room (note: Azure targets always return ControlRoom() == false)
• Verify control room is currently configured (non-empty control_room_* fields — nothing to sever if already empty)
• Verify all Pulumi stacks are in a clean state (no pending operations, no locked stacks)
• Verify workload is healthy: cluster reachable (EKS for AWS, AKS for Azure), pods in Running state, sites responding
• Optional: verify control room is reachable (can we actually delete the Mimir secret?). Control room is always AWS regardless of workload cloud provider.
• Report any blockers before proceeding — clear error messages for each check that fails

Acceptance Criteria

• Pre-flight catches obvious problems (locked stacks, unreachable cluster, already-ejected workload) before any changes are made
• Works for both AWS workloads (EKS) and Azure workloads (AKS)
• Each failing check reports a clear, actionable message
• All checks pass before the orchestrator proceeds to severance

Read the severance orchestrator entry point first, then trace how it accesses workload targets, control-room configuration, and Pulumi stacks. Done means AWS and Azure workloads are checked for valid targets, configuration, clean stacks, and health before changes begin, with actionable blockers reported for every failed check.