check boundary NTP sync status in planner before upgrading it

[davepacheco]

From #8546:

We probably want to avoid taking down a boundary NTP zone while the other one is not sync'd up with its upstream.

Once we have #8546, the planner needs to check this in the function that checks if it's okay to take down a boundary NTP zone.

(reference: https://rfd.shared.oxide.computer/rfd/565#_automation)