Phase 5: add service rollout cutover readiness

[kacy]

Summary

• add a service rollout cutover-readiness summary for status and Prometheus
• surface explicit blockers for reconciler and VIP cutover decisions
• add downgrade-safety coverage to ensure the service_names compatibility mirror is preserved and repaired

Commit

• 3020b09 Add service rollout cutover readiness summary

Verification

• zig fmt on touched files
• bounded zig build test -Doptimize=ReleaseSafe runs, one at a time, for:
  • route handles /v1/status?mode=service_rollout GET
  • route rollout status reports reconciler cutover ready after clean backfill and audit
  • handleMetricsPrometheus exposes service rollout metrics
  • audit repair preserves compatibility mirror for downgrade safety in vip mode
• each run timed out without emitted failures