Ceiling on the percentage of a service's instances ejected at once.

A correlated failure — a bad deploy, a shared dependency — makes every instance report failures at the same time, and ejecting all of them turns a partial outage into a total one. An ejection that would push past this cap simply does not happen.