feat(ha-heartbeat-liveness): add validate_heartbeat_config startup check (task 1.2)

Enforce heartbeat_timeout_ms >= 2 * heartbeat_interval_ms at startup.
validate_heartbeat_config() in startup_validation.c returns -EINVAL with
error message on violation; wired in cluster_init_phase1 before ha_init().
4 unit tests added to test_ha_startup.c.

src/controller/startup_validation.c

@@ -1,14 +1,17 @@
 /* startup_validation.c — Startup pre-flight validation functions.
  *
  * Implements validate_vcpus(), validate_startup_config(),
- * validate_peer_count(), and validate_cert_files() for use in main.c
- * and the controller unit test suite.
+ * validate_peer_count(), validate_cert_files(), and
+ * validate_heartbeat_config() for use in main.c and the controller
+ * unit test suite.
  *
  * Requirements: 4.1 (peer count), 4.2 (cert pre-flight),
- *               4.3 (vcpus), 4.4 (vcpus key deprecation warn)
+ *               4.3 (vcpus), 4.4 (vcpus key deprecation warn),
+ *               2.4 (heartbeat timing validation)
  */
 #define _GNU_SOURCE
 #include <errno.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
@@ -123,3 +126,43 @@ int validate_cert_files(const char *cert_path, const char *key_path,
 
     return 0;
 }
+
+/* ── Req 2.4: heartbeat timing validation ─────────────────────────────── */
+
+/*
+ * validate_heartbeat_config: enforce heartbeat_timeout_ms >= 2 * heartbeat_interval_ms.
+ *
+ * A timeout smaller than two intervals means the standby could declare the
+ * primary dead before a single missed heartbeat has elapsed — that is an
+ * operator misconfiguration that must be caught at startup.
+ *
+ * Returns 0 when the relationship holds (valid config).
+ * Returns -EINVAL when heartbeat_timeout_ms < 2 * heartbeat_interval_ms;
+ * writes a human-readable error message into err_buf.
+ */
+int validate_heartbeat_config(uint32_t heartbeat_timeout_ms,
+                              uint32_t heartbeat_interval_ms,
+                              char *err_buf, size_t err_len)
+{
+    if (err_buf && err_len > 0) {
+        err_buf[0] = '\0';
+    }
+
+    if (heartbeat_timeout_ms < 2 * heartbeat_interval_ms) {
+        if (err_buf && err_len > 0) {
+            snprintf(err_buf, err_len,
+                     "heartbeat_timeout_ms (%u) must be >= 2 * heartbeat_interval_ms (%u); "
+                     "current ratio %.2f is below the minimum of 2.0 — "
+                     "set heartbeat_timeout_ms >= %u",
+                     heartbeat_timeout_ms,
+                     heartbeat_interval_ms,
+                     heartbeat_interval_ms > 0
+                         ? (double)heartbeat_timeout_ms / (double)heartbeat_interval_ms
+                         : 0.0,
+                     2 * heartbeat_interval_ms);
+        }
+        return -EINVAL;
+    }
+
+    return 0;
+}