planner: adding new zones needs to know whether all lower-level updates are complete

[jgallagher]

This is closely related to #8284 and #8285, but those are phrased more in terms of "update"; this issue calls out that we have a similar problem when adding a new zone.

When the planner adds a new zone, it currently calls image_source_for_new_zone() (to determine the image source), which internally calls is_zone_ready_for_update() to decide whether to use the new or old TUF repo. is_zone_ready_for_update() has this TODO:

omicron/nexus/reconfigurator/planning/src/planner.rs

Lines 1523 to 1525 in 17e4c0e

	// TODO-correctness: We should return false regardless of `zone_kind` if
	// there are still pending updates for components earlier in the update
	// ordering than zones: RoT bootloader / RoT / SP / Host OS.

There are a number of cases where we might need to add a new zone in the middle of an upgrade, including at least:

• a new sled has been added (it will need NTP and crucible zones)
• a sled or disk was expunged, and it had services on it that now need to be restarted elsewhere to restore redundancy

In these cases, the planner needs to consider whether all RoT / SP / OS updates are complete to decide whether to start the new zone from the latest TUF repo or the previous one. I think this might be as "simple" as teaching is_zone_ready_for_update() how to check the results of do_plan_mgs_updates() which (after #8284) should be able to report whether all such updates are complete.