Graceful zero-downtime deploys

Deploys are zero-downtime by default. A new version is started and health-checked before any traffic moves to it — the version that's already running keeps serving requests until the new one is confirmed healthy, then traffic swaps over cleanly.