Move version validation into provisioner

By validating the PE version after the provisioner merges configs, we can
ditch a bunch of troublesome logic in `Config::PEBootstrap` that messed with
global state.