Blueprint planner safety: don't upgrade a boundary NTP zone if the other boundary NTP zone isn't sync'd #8360
Description
RFD 565 describes a slight variant of this:
If either boundary NTP zone is not sync’d up with its upstream, the sled hosting the other boundary NTP should not be rebooted for update. (This is not necessarily a hard requirement, since time generally does not drift that quickly. But there’s no reason not say that one should resolve issues with boundary NTP before completing an upgrade.)
We should not only avoid rebooting the sled hosting the sync'd NTP zone, we should also avoid upgrading that zone itself (which would expunge it, leaving us with no sync'd boundary NTP).