Merge branch 'working' into job_peek_lchen

job_peek_lchen: Add fetchfile feature (job output/error peek proxy)
working: HA/Raft infrastructure (consensus, replication, config mgmt)

Conflict resolution summary:
- controller.capnp: fetchfile @41, fetchfilereply @18, fetchfilemsg @30
- cluster.c: bifurcated OPCode_reply for fetchfile + config-push ACK
- job.c: kept full fetchfile pending-request subsystem (~183 lines)
- request.c: kept both xce_fetchfile_req() and XCE_RETRY_DEFAULTS
- helper.c: added missing preVoteRequest/preVoteReply mappings
- All 15 new test registrations (test_cbuf.c + 14 HA tests)

src/frontend/apiserver/controllers/jobs.go

@@ -1535,6 +1535,13 @@ func preCheckJobRequest(req *models.JobSubmitRequest) ([]int, error) {
 	if req.QueueName == "" {
 		req.QueueName = "normal"
 	} else {
+		// Reject submissions to the reserved internal recovery queue.
+		if req.QueueName == "lost_and_found" {
+			logger.Error("Job submission to reserved queue rejected",
+				zap.String("queue_name", req.QueueName))
+			return nil, fmt.Errorf(
+				"cannot submit jobs to 'lost_and_found' — this is an internal recovery queue")
+		}
 		//validate queue_name whether exists
 		queueInfo, ok := store.Queues.Get(req.QueueName)
 		if !ok {