Upgrade CDK

upgrade-cdk automates the CDK (Charmed Distribution of Kubernetes) upgrade
workflow using the Jubilant library.

Features:
- Charm refresh – refresh charms from a CSV manifest in the correct order
- Config management – validate and apply application configuration
- State monitoring – wait for units to reach active/idle after each step
- ETCD backup – snapshot the etcd cluster before any upgrade begins
- Sequential unit upgrades – upgrade control-plane and worker units one

 at a time with interactive confirmation

- Blue-green worker migration – replace workers one-by-one with new

 machines using full cordon + drain + remove lifecycle

Usage:

upgrade-cdk <controller>:<model> <channel>

upgrade-cdk <controller>:<model> <channel> [charms.csv]

upgrade-cdk <controller>:<model> <channel> --bluegreen

upgrade-cdk <controller>:<model> <channel> [charms.csv] --bluegreen --parallel 3

When no CSV file is given the bundled charms.csv is used.

Why classic confinement?
upgrade-cdk requires unrestricted filesystem access to:
- Juju credentials at ~/.local/share/juju (written by the juju snap)
- Kubernetes config at ~/.kube/config or $KUBECONFIG
- SSH keys used for juju scp operations
- The juju snap binary at /snap/bin/juju