Make restart reconciliation atomic

[cstanislawski]

No description provided.

[cstanislawski]

A restart action and its acknowledgement need to be recorded atomically.

Previously, the controller updated the pod template first, then separately removed restart-at or advanced last-restart-timestamp. A crash, conflict, lost response, or leader transition between those writes left a completed rollout looking pending, so the next reconciliation could trigger it again.

This change writes both sides of the action in one patch: restartedAt plus removal of restart-at for one-time restarts, or restartedAt plus last-restart-timestamp for recurring restarts. Stale patches fail without changing the object, then reconciliation retries from the latest version.

The fix covers both one-time and recurring restarts. Regression tests simulate a committed patch with a lost response and a concurrent update conflict, proving that each restart window is applied at most once.