Cap concurrent macOS runner image rolls during fleet updates

Runner pool image changes no longer pull the new multi-gigabyte image on every node at once. The runners controller now limits how many Pods can roll concurrently, using a configurable spec.rollout.maxConcurrentPercent field that defaults to 5%. This keeps more of the warm pool available during digest rolls, preventing queue backups that previously left jobs waiting for minutes.