Presence-driven regrading: a host in use or leaving gives up its vote #223

The dynamic regrading epic (#179) lets the controller swap an etcd voter by health. This follow-up lets presence decide as well: a host that is in use or leaving is unfit to hold a vote, a host that is available and on a fast link is a candidate, and a mobile voter is swapped back to a stable standby once one is fit.

The presence agent itself, the node VM lifecycle and the signed fleet record that carries a host's state live in a separate fleet agent that runs on every host (tracked in the organisation's private fleet agent repository). The controller here only reads the presence label that agent mirrors onto a node, and applies the existing swap, with its snapshot, drain, gates, cooldown and rollback, to what it reads.

Sub-issues: the fitness rule (#220) and the swap-back rule (#221). Both are blocked by the presence agent.

Done when a voter that becomes in use is replaced through the existing swap with no manual step, and a mobile voter is returned to a stable host once one is fit, with hysteresis so a host that flaps does not cause repeated swaps.