Add atomic code upgrade test coverage

[Copilot]

Closes #3390.

CCF supports replacing an old node set with a non-overlapping new node set via one governance reconfiguration proposal. This adds coverage and docs for that atomic code upgrade path.

• Atomic reconfiguration helper
  • Added Consortium.replace_nodes() to trust multiple pending nodes and retire multiple existing nodes in one proposal.
  • Kept replace_node() as the single-node wrapper.

network.consortium.replace_nodes(
    primary,
    old_nodes,
    new_nodes,
    valid_from=valid_from,
)

• Code upgrade test

  • Added test_update_all_nodes_atomically().
  • Starts a full replacement node set with the new package.
  • Submits one proposal containing all transition_node_to_trusted and remove_node actions.
  • Waits for primary election among the new nodes, then removes retired old nodes.
  • Preserves sequential upgrade coverage by upgrading back afterward.

• Operations documentation

  • Documented the atomic alternative in the code upgrade procedure.
  • Clarified that new nodes should remain pending until the atomic proposal is submitted.

[achamayou]

@copilot check code format and drop the reference to #1713, that's been addressed long ago.

[Copilot]

@copilot check code format and drop the reference to #1713, that's been addressed long ago.

Addressed in a870d10. I re-ran the targeted Python format check and removed the stale #1713 references from the updated code path.

[achamayou]

@copilot look at the last complete Virtual C test and fix the failure. Don't forget to format the code.