Upgrade smoothly by default

Change the default behavior for einhorn reloads.

Previously, the default behavior for reloads was to spin up a whole fleet of new workers, wait for them all to ACK, and then spin down the old workers. This will roughly double the memory usage on the host during the upgrade, which is undesirable when memory is already the bottleneck for a service.

Now, the default behavior for reloads will be to iteratively spin up a few new workers, wait for them to ACK, and spin down an equal number of old workers. This way the total number of workers running at any time is much more constant. The old behavior is still accessible as `upgrade_fleet` in the command interface.

By default, `max_unacked` for the smooth upgrade procedure will be set to the number of CPUs on the host.