We probably want to avoid taking down a boundary NTP zone while the other one is not sync'd up with its upstream.

To implement this, the planner needs access to the upstream sync status of the boundary NTP zones. We should put this into inventory.

(reference: https://rfd.shared.oxide.computer/rfd/565#_automation)