So an instance can itself detect it's not able to update, it would need to know it's not on latest. And endpoint to easily do that from the Evergreen Jenkins plugin, and then surface an Admin Monitor alert, would be good.
The backend should expose a publicly accessible endpoint returning the current updateLevel.
(Possibly, this would include the channel for it given also it's easy to retrieve from the disk of the instance, and is next to the current updateLevel).
(This would allow the Evergreen Jenkins plugin to consume this easily and display a warning using for example an AdministrativeMonitor to inform users that their instance has the automated upgrade system broken in some way.)