[Features] Manage instance membership in ITS and ITS2 #11015

What is the user interaction of your feature

InstanceSet users need MemberJoin and MemberLeave to run as part of workload expansion and retirement in both implementations: ITS manages Pods/PVCs, while ITS2 manages Instances that own Pods/PVCs.

Describe the solution you'd like

• Use the lifecycle APIs introduced in feat(workloads): introduce data and membership lifecycle APIs #11014 and the existing public lifecycle executor.
• Register the initial allocation separately from later expansion, including zero initial replicas and allocation while stopped.
• Maintain Provisioned from observed runtime and MemberJoined from successful membership actions. ITS2 commits the Instance result before aggregating it into InstanceSet status.
• Perform Join on usable new members and Leave before scale-in/replacement releases runtime resources, preserving existing admission, Stop, Offline and storage-retention policies.
• Recover after action failures, status-write conflicts, lost parent aggregation and controller restarts. Actions can retry before their result is committed.
• Verify both controller entry paths and real API-server status-subresource conflicts, with correct workload DNS and executor selection.

Additional context

This is the member-management portion of the three-PR split discussed in #10958. The API is #11014; data loading remains a separate third PR. No additional API or persistent state, data tasks, Component integration or execution framework is required. The original #10958 remains unchanged.