[Upgrade] Implement Substrate System Upgrade #1197

Implement the substrate system upgrade that can do upgrade from end to end.

Approved Design doc(#473): https://docs.google.com/document/d/1JduAyGZFyqdNp4UhKiv0EN-is3iW5tf5BwGTWbt2ouI/edit?usp=sharing&resourcekey=0-MXG12QCkleIxhY7cOB7g6A

Task list

• Reanme ateomImage as workerImage for WorkerPool #861 — workerImage optional (+ rename from ateomImage): PR api: rename ateomImage to workerImage and make it optional #1210
• Leader election for ate-controller, so exactly one controller acts during the handover window: PR atecontroller: enable leader election #1212
• [Upgrade] versioned default worker image per sandbox class #1268 — compiled-in versioned default worker image per sandbox class
• [Upgrade] make atecontroller able to create a worker set corresponding to its own Version #1269 — version-keyed worker sets: the controller only creates and mutates sets of its own build version, pod nodeSelector pins workers to same-version nodes
• [Upgrade] Versioned atelet DaemonSet #1270 — versioned atelet DaemonSets selecting nodes by the ate.dev/substrate-version label; install-time node labeling

Upgrade tooling and ops

• [Upgrade] System upgrade runbook #1272 — upgrade driver (run / rollback / status / cleanup)
• [Upgrade] Rollback support for system upgrade CLI/binary/script #1273 — rollback support
• install-ate.sh --upgrade-ate-system: orchestration, GKE node pool handling
• Runbook + demo

Docs

• [Upgrade] Add an api_changes.md: rules for changing protos and CRDs #1185 — api-changes.md: rules for changing protos and CRDs
• version-skew-policy.md, the supported component version combinations