Change coordinators should have a safety check

[johscheuer]

What would you like to be added/changed?

We should add a safety check to the change coordinator action like a specific uptime of the cluster to reduce the risk of frequent recoveries. For the coordinator case we should differentiate cases where the process is only excluded and where the process is missing. The latter is more urgent might be a good reason to bypass some of the safety checks.