feat: ha_do_promote/demote + SIGUSR1 atomic flag handler (P1-3a)

- ha_do_promote(): atomic_fetch_add term, set role=PRIMARY, reset
  last_received_crc to WAL_CRC_NONE (COH-5 chain restart on promotion)
- ha_do_demote(): set role=STANDBY, reset hooks_registered idempotency guard
- ha_install_sigusr1(): sigaction handler stores only atomic int —
  async-signal-safe per POSIX.1-2017 §2.4.3; global g_sigusr1_ha set
  once before signals are enabled
- ha_promote_to_primary() / ha_demote_to_standby() remain (void)c stubs
  pending P1-5 cluster wiring

Tests: 3 new cases in test_ha_role.c
  test_promote_increments_term: term > term_before, role == PRIMARY
  test_demote_sets_standby_role: role reverts to STANDBY after promote+demote
  test_sigusr1_sets_failover_requested: raise(SIGUSR1) sets atomic flag
Result: 100 Tests 0 Failures 0 Ignored (controller suite)

src/controller/ha.h

@@ -97,6 +97,29 @@ int  ha_promote_to_primary(cluster_t *c);
  */
 int  ha_demote_to_standby(cluster_t *c);
 
+/* ── Internal promotion/demotion (P1-3a) ───────────────────── */
+
+/*
+ * ha_do_promote: increment term, set role=PRIMARY, reset last_received_crc.
+ * No cluster_t dependency — fully testable standalone.
+ * Callers: ha_promote_to_primary() (P1-5), watchdog failover path.
+ */
+void ha_do_promote(ha_state_t *ha);
+
+/*
+ * ha_do_demote: set role=STANDBY, reset hooks_registered idempotency guard.
+ * Hook disable requires cluster_t and is done in ha_demote_to_standby() (P1-5).
+ */
+void ha_do_demote(ha_state_t *ha);
+
+/*
+ * ha_install_sigusr1: register a SIGUSR1 handler that atomically sets
+ * ha->failover_requested. The handler uses only async-signal-safe operations
+ * (atomic store on an int-width type — POSIX.1-2017 §2.4.3).
+ * Must be called once, before any signal can arrive.
+ */
+void ha_install_sigusr1(ha_state_t *ha);
+
 /* ── Watchdog thread API (P1-3) ────────────────────────────── */
 
 /*