[austin-barrington]

Two bugs found on shared-pool-1 after v0.3.1.

1. A pool stuck in a rolling restart never recovered. The pool's proxy was down when a rolling restart began. The restart then retried excluding a pod from the proxies forever and returned early on every pass. Because the proxy Deployment was applied only after the restart step, v0.3.1's proxy fix never landed. It needed the restart state cleared by hand.

• The proxy Deployment is now applied before the rolling restart.
• Exclude and include go to every proxy pod whose process is running, Ready or not, and skip pods that aren't running. Requiring Ready also deadlocked one-node pools: a proxy is Ready only with a routable backend, so excluding the only backend made every proxy un-Ready and the include never went out. A proxy that isn't running holds no exclusions (they're in memory), so it starts clean.
• Exclude now treats 409 (already excluded) and the proxy's own "not found in pool" 404 as done, so a retry after a partial failure succeeds. Any other 404, such as a wrong port, is still an error.
• A restart that has excluded nothing while no update is pending is cleared automatically. That's what was done by hand on the pool.

2. A stale Degraded=True stayed on healthy pools. setFailedStatus set it and nothing cleared it. It's now set to False (reason Reconciled) once a reconcile completes.

Chart and README bumped to 0.3.2; docs/compatibility.md has an upgrade note. No pod templates change.

Tests:

• New envtest specs:
  • the stuck pool (pending update, restart waiting to exclude pod 0, only proxy crash-looping): one reconcile applies the proxy Deployment, probing admin, and moves past the exclusion;
  • an unstarted restart with no pending update is cleared;
  • a stale Degraded becomes False.
• A spec where exclude/include reach a running but un-Ready proxy and skip a crash-looping one.
• A unit test for the exclude response codes.
• Mutation-checked: putting back the readiness gate, the late proxy apply, the stale state, or a Degraded left True each fails a spec.
• go test ./... with envtest, go vet, and make lint (0 issues) pass.