Pod disruption budget

A declaration of how much of a workload may be voluntarily unavailable at once, which drains and upgrades must respect. It is the only thing standing between a routine cluster upgrade and every replica of a service being evicted in sequence faster than it can start. It constrains only voluntary disruption — a node catching fire does not consult it — and a budget that can never be satisfied will wedge an upgrade indefinitely.