feat: P3-6 ha_trigger_manual_failover_for_test() shim + 3 failover cycle tests

Add test-only function ha_trigger_manual_failover_for_test() to exercise manual
failover state machine (demote → promote cycle) without requiring live cluster_t.

Test coverage:
- test_manual_failover_transitions_role_and_increments_term: Validates role
  transitions (PRIMARY → STANDBY → PRIMARY) and term monotonicity
- test_manual_failover_resets_hooks_registered: Confirms demotion resets the
  hooks_registered idempotency guard
- test_manual_failover_monotonic_term_across_multiple_cycles: Validates term
  remains monotonically increasing across 5 consecutive failover cycles

Implementation:
- Exposed only under #ifdef XCE_TESTING in ha.h
- Function body (6 lines): calls ha_do_demote() then ha_do_promote(); returns
  the new term value via atomic_load_explicit()
- Enables design validation (P3-6) without test-cluster infrastructure

All tests pass. Build clean.

src/controller/ha.h

@@ -158,4 +158,15 @@ int ha_should_redirect(const ha_state_t *ha);
  */
 int ha_no_primary_known(const ha_state_t *ha);
 
+/* ── P3-6: Test-only failover shim ────────────────────────────── */
+
+#ifdef XCE_TESTING
+/* Test-only shim: demote then re-promote; returns new term.
+ * Exercises the manual failover state machine without a live cluster_t.
+ * Calls ha_do_demote() then ha_do_promote(); validates role transitions
+ * and term monotonicity. See design doc P3-6 and src/docs/persistence-and-ha-design.md.
+ */
+uint64_t ha_trigger_manual_failover_for_test(ha_state_t *ha);
+#endif
+
 #endif /* HA_H */