feat(ha-commit-barrier-rollout): config barrier with production ACK ingestion (task 5.2 + r1)

configAck branch: per-push majority (acked_config_lsn >= push_tag,
1+count > n_peers/2 over r->ce->n_peers, n_peers<=1 immediate,
ce==NULL -EINVAL); legacy >0 counting and n_active==0 shortcut dead.
push_config_to_standbys returns the barrier result; upgrade failure ->
send_upgrade_error (rc forwarded), no success ACK, no restart,
committed_config_tag success-only.

Remediation r1 (two CRITICAL review findings):
- F1: wire production config-ACK ingestion — replconfigpushreplymsg
  decode branch in repl_ack_decode_and_dispatch -> repl_on_config_ack
  on the promoted-vote ep; + defensive cluster.c OPCode_reply case.
  Closes the unlanded half of ha-config-bootstrap 8.1; without this the
  barrier would brick every multi-member config upgrade. No schema change.
- F2: keep the barrier off the iomgr thread — export
  push_config_transport_only (non-blocking) for the 5 ha.c + join.c
  streaming sites; barrier path now vtask-only (do_upgrade_config).

Wire-path test drives real capnp ACK bytes through the production decode
branch. 30/30 rollout, 6/6 repl_majority, 46/46 config_repl; census 0
FAIL; pre-existing fixture leak only (less than baseline).

src/controller/join.c

@@ -182,9 +182,12 @@ static int handle_controller_join(cluster_t* c, endpoint_t* ep,
              c->ha.standby_endpoints->count);
 
         /* Immediately push current config to the newly-joined standby so it
-         * doesn't have to wait for the next scheduled push. */
+         * doesn't have to wait for the next scheduled push.  Transport-only
+         * (no barrier wait — task 5.2 remediation r1): this is a best-effort
+         * catch-up stream; convergence is owned by the OP_replConfig
+         * anti-entropy pull and the heartbeat decision loop. */
         if (ha_is_primary(&c->ha))
-            push_config_to_standbys(c, NULL, 0, NULL, 0, NULL);
+            push_config_transport_only(c, NULL, 0, NULL, 0, NULL);
     }
 
     return 0;