Carry rollout identity through autoscaler replacement claims

When a deployment hands worker replacement to an autoscaler, preserve the target image revision and old worker identity in the controller's existing durable replacement claim. A controller restart or ordinary scaling cycle can otherwise replace a candidate using the previous default image or reopen admission on a worker whose drain intent must persist. Before stopping any worker, fence the exact service and deployment identity and require fresh zero active and pending work. A completed claim must stop constraining the next release; an unfinished claim should resume with its original target.

Applies when: A controller owns asynchronous replacement after a release job relinquishes control. Keywords: Railway autoscaler rollout drain replacement claim immutable image restart LiveKit