Pre-severance checks

[timtalbot]

Parent: #208

Summary

Before severing, run pre-flight checks to verify the workload and control room are in a good state. Catch obvious problems before any changes are made.

Requirements

• Verify workload target exists and is not itself a control room (note: Azure targets always return ControlRoom() == false)
• Verify control room is currently configured (non-empty control_room_* fields — nothing to sever if already empty)
• Verify all Pulumi stacks are in a clean state (no pending operations, no locked stacks)
• Verify workload is healthy: cluster reachable (EKS for AWS, AKS for Azure), pods in Running state, sites responding
• Optional: verify control room is reachable (can we actually delete the Mimir secret?). Control room is always AWS regardless of workload cloud provider.
• Report any blockers before proceeding — clear error messages for each check that fails

Acceptance Criteria

• Pre-flight catches obvious problems (locked stacks, unreachable cluster, already-ejected workload) before any changes are made
• Works for both AWS workloads (EKS) and Azure workloads (AKS)
• Each failing check reports a clear, actionable message
• All checks pass before the orchestrator proceeds to severance