Cap concurrent runner image rolls to prevent macOS warm-pool collapse

A new digest roll used to make every node pull the new Tart image at once, collapsing the warm macOS pool and backing up the queue. The runners-controller now caps how many Pods can be mid-roll at a time via spec.rollout.maxConcurrentPercent (default 5%). Only Pods carrying the new drain-eligible label are drained, and the controller marks more only as rollers become Ready. New roll metrics expose progress and stuck rolls.