feat(raft-ha-core-safety): establish snapshot (term,lsn) boundary on install (task 3.2)

Adds checkpointTerm (@6, append-only) to the SnapshotTransfer wire
message. The leader stamps it via persist_entry_term(p, checkpoint_lsn)
when sending a snapshot; the standby reconciles it into its own
per-LSN term index (persist_reconcile_checkpoint_term) right after
persist_load_snapshot succeeds, before applied_lsn advances. This
authoritatively overwrites any stale local term a divergent
pre-snapshot entry left at the checkpoint LSN, closing the gap task
3.1's RED test proved (Expected 7 Was 3 -> now passes). Transport
stays persist_t-free; the reconcile lives in persist.c per the
existing dependency direction. Decode is auto-generated via capnp
mapname; only the hand-rolled encode path (request.c/typemap.h, needed
for the raw snapshot payload) required a matching manual update.

test_ha_core_safety 25/0, test_config_repl 66/0, no ASAN reports.

src/controller/config_repl.h

@@ -397,8 +397,16 @@ int ha_stream_wal_to_standby(endpoint_t *ep, const char *wal_path,
 
 #define SNAPSHOT_CHUNK_SIZE 65536
 
+/* raft-ha-core-safety task 3.2 (Req 3.1/5.1): checkpoint_term is the leader's
+ * own term for checkpoint_lsn (caller sources it via
+ * persist_entry_term(p, checkpoint_lsn) before calling — this function stays
+ * persist_t-free, per the layering invariant that the transport layer never
+ * reaches into persistence internals). Stamped onto every chunk so the
+ * standby can reconcile its per-LSN term index at the boundary after
+ * install, regardless of which chunk it processes last. */
 int ha_send_snapshot_to_standby(endpoint_t *ep, const char *snap_dir,
-                                 uint64_t checkpoint_lsn);
+                                 uint64_t checkpoint_lsn,
+                                 uint64_t checkpoint_term);
 
 uint64_t ha_compute_oldest_wal_lsn(const char *wal_path);