feat(raft-ha-core-safety): establish snapshot (term,lsn) boundary on install (task 3.2)

Adds checkpointTerm (@6, append-only) to the SnapshotTransfer wire
message. The leader stamps it via persist_entry_term(p, checkpoint_lsn)
when sending a snapshot; the standby reconciles it into its own
per-LSN term index (persist_reconcile_checkpoint_term) right after
persist_load_snapshot succeeds, before applied_lsn advances. This
authoritatively overwrites any stale local term a divergent
pre-snapshot entry left at the checkpoint LSN, closing the gap task
3.1's RED test proved (Expected 7 Was 3 -> now passes). Transport
stays persist_t-free; the reconcile lives in persist.c per the
existing dependency direction. Decode is auto-generated via capnp
mapname; only the hand-rolled encode path (request.c/typemap.h, needed
for the raw snapshot payload) required a matching manual update.

test_ha_core_safety 25/0, test_config_repl 66/0, no ASAN reports.

src/include/typemap.h

@@ -338,6 +338,11 @@ struct snapshot_transfer_s {
      * owned by the struct, freed by xce_free_request(). */
     uint8_t    *raw_payload;
     size_t      raw_payload_len;
+    /* raft-ha-core-safety task 3.2 (Req 3.1/5.1): the leader's term for the
+     * checkpoint LSN above. 0 = unset (legacy sender) -> receiver treats as
+     * WAL_LEGACY_TERM, same convention as persist's existing legacy-0 term
+     * mapping (see entry_term_locked in persist.c). */
+    uint64_t    checkpoint_term;
 };
 
 struct wal_catchup_entry {