checkpoint: bug-851 root cause + raft TLA+ conformance spec family

Investigation & fixes (failover committed-job loss):
- root-cause bug-851 on an owned 3-node cluster: chaotic failover causes
  silent committed-prefix divergence (WAL hdr.term always 0; two leaders
  per term; no (term,lsn) reconcile). Evidence in repro-851/ + INVESTIGATION.
- live-validated fixes 848/849/850 (recovery-on-promotion, advertise real
  applied_lsn, persist-layer contiguity guard); add waldump WAL inspector.

Specs (strict raft.tla conformance — library owns the log):
- TLA-gap-analysis.md: impl vs raft/raft.tla, gaps G1-G6.
- raft-log-replication, raft-commit-safety, raft-sim-conformance: extend
  src/lib/raft to own log/commit/verification via callbacks (specs generated,
  cross-spec review passed).
- ha-term-safety: controller-side adapter + config marker (R1-R7); design done.
- config-upgrade-snapshot: R8 descoped here (deps entity-bearing-snapshots, bug-857).
- roadmap + buglog (851/854/857) + .wolf knowledge updated.

src/controller/meson.build

@@ -53,7 +53,7 @@ controller = executable('xce_controller',
                         link_args: wrap_link_args,
                         install: true)
 
-xce_test_src = [ 'testsuite/test.c']
+xce_test_src = [ 'testsuite/test.c', 'testsuite/waldump.c']
 
 readline_dep = dependency('readline')
 ncurses_dep = dependency('ncurses')
@@ -67,6 +67,8 @@ xce_test_deps = [
   history_dep,
   ncurses_dep,
   tinylog_dep,
+  zlib_dep,        # waldump: crc32 WAL validation
+  c_capnproto_dep, # waldump: decode JOB_SUBMIT jobid
 ]
 xce_test = executable('xce_test',
                       xce_test_src,
@@ -136,6 +138,8 @@ controller_unit_test_src = [
   'testsuite/test_ctrlstatus.c',
   'testsuite/test_ha_heartbeat_committed.c',
   'testsuite/test_ha_vote_floor_heartbeat.c',
+  'testsuite/test_waldump.c',
+  'testsuite/waldump.c',
   'ctrlstatus.c',
   'commit.c',
   'job.c',