push site config to the load balancers

Replace the live site config and reload nginx, per node. Gated on a passing nginxsite_check over these exact bytes for every target node.

Replaces the live nginx site config and reloads, per node, through the fleet's own validated contract (lb-push/lb-apply): the far side re-validates against its full live tree before promoting, promotes atomically, re-runs nginx -t and rolls back if the tree breaks : a config that fails validation never replaces a live one. The block-side gate is the point: push refuses to run unless the checks pin carries a PASSING nginxsite_check result for every node in ITS OWN nodes list, for this site, with a checksum matching these exact bytes. A validation failure anywhere leaves every node untouched, including the ones that would have accepted it. FLEET SHAPES: on a shared-filesystem fleet (live configs on a filesystem all nodes mount, watchers converging : the rual a-cluster LB trio is this shape) pass exactly ONE node here: the shared fs distributes, the other nodes' watchers validate and reload within seconds, and pushing the same bytes N times only reloads N times for one change. Check may and should still fan out to every node. On an independent fleet, list every node and read the per-node results. Past the gate the push is deliberately NOT atomic across nodes: each node validates and swaps on its own, and a node that refuses keeps serving what it had. nginxsite_status answers whether the fleet agrees afterwards.