Subscription canary rollout

Scenario

Upstream provider endpoint changed, and traffic must keep passing during evaluation.

Sequence

1. Update candidate list and keep current revision active.
2. Run hubctl subscription refresh to test candidates in canary namespace.
3. Compare health status and apply only if candidates stay healthy.

hubctl subscription refresh corp-egress
hubctl status --state-dir /var/lib/vpn-hub
hubctl deploy --confirm-within 5m