Rolling deploy should start with any unhealthy hosts

[bryannewrelic]

Centurion's rolling_deploy action iterates over the hosts: for each, it kills the old container, starts a new one, then waits for the new one to successfully health-check before moving on. With this paradigm, you clearly need to have at least two hosts running something to maintain uptime.... but if the second host is already down for some reason, having only two instances means deploying (or running a migration command) will blindly take your only other instance down.

Rolling deploy (and also anywhere we pick a host to do something on) ought to look for any "down" hosts and deploy to them first.

[relistan]

I'd really like to see us get this in... anyone want to take a stab at it?

cc @dselans, @benders @intjonathan