Build a fleet rollout mechanism

[JSONbored]

Decision (ratified 2026-07-21): pinned_version field on the control-plane's tenant record. A rollout is updating one or more tenants' pinned_version; rollback is reverting it for the affected tenant(s). Each tenant's container reads its own pinned version at (re)start rather than always pulling :latest.

Problem: There's no way today to stage a new version across a fleet of instances, target a rollout at one customer, or roll one back without affecting others — every self-hoster pulls the same image tag from the same release channel.

Area: ORB / Fleet ops. Buildable now: #7180's control-plane provisioning core is decomposed into 4 real pieces (#7653, #7654, #7851, #7852).

Deliverables:

• pinned_version added to the control-plane's tenant record (control-plane/src/tenant-provisioning-driver.ts's Tenant type), product-agnostic (same shape for ORB and AMS tenants).
• Container (re)start resolves its image reference from the tenant's own pinned_version, not a shared :latest tag.
• Rollout/rollback = updating one or more tenants' field via an explicit list (no percentage/canary selector — no such primitive exists elsewhere in this codebase to build on; don't invent one speculatively).
• Tests: rolling one tenant forward/back leaves every other tenant's pinned version and running container completely unaffected.

Acceptance criteria:

• One instance can be rolled forward or back independently of every other instance, proven by test.

AMS Cloud Readiness cross-reference (added 2026-07-12)

See also #5221 in the AMS Cloud Readiness milestone — the AMS-side parallel to this exact problem. Keep both sides in sync if either design changes.

Contributor-eligible. Decision ratified above; the per-tenant-independence test requirement is the safety guardrail against the fleet-wide blast-radius concern.

[linear-code]

JSO-3558

[JSONbored]

Depends on #7180 (shared provisioning core) — targeted per-instance rollout needs the provisioning/registry layer to know about instances in the first place.