feat(raft-apply-decoupling): post-replay apply-correctness verification (task 5.1)

Add apply_verdict_t (APPLY_CLEAN/APPLY_DIVERGENT) computed alongside
the existing structural (CRC) recover_verdict_t. Dual-check design:
an entity-count check (WAL_JOB_SUBMIT entries scanned vs live jobmgr
growth, genuinely independent of apply_committed_entry()'s return
code) and a position check against a new last_applied_lsn field
(forward-looking infrastructure for task 6's live pump).

Fixes a real bug found during review: the position check's
expectation was computed from the physical WAL-scan tip
(current_lsn - 1), which advances past checkpoint markers and
unknown entry types that never reach apply_committed_entry(). A
crash between persist_checkpoint()'s marker-fsync step and its
later snapshot-persist step leaves a trailing checkpoint marker on
next boot, which falsely reported APPLY_DIVERGENT on a perfectly
clean recovery -- reachable today, not gated behind a future task.
Fixed by reading last_applied_lsn directly, which only advances for
entries actually dispatched through the apply seam.

Known accepted gap: entity-count check covers jobs only, not
workers (which can genuinely be created via WAL_WORKER_CTRL) --
documented for future extension.

src/controller/testsuite/controller_test.c

@@ -81,6 +81,7 @@ extern void test_apply_seam(void);
 extern void test_apply_committed_entry(void);
 extern void test_replay_apply_seam(void);
 extern void test_apply_reapply_idempotency(void);
+extern void test_apply_correctness_verification(void);
 
 void setUp(void) { return; }
 
@@ -231,6 +232,7 @@ int main(int argc, char* argv[])
     TEST(test_apply_committed_entry);
     TEST(test_replay_apply_seam);
     TEST(test_apply_reapply_idempotency);
+    TEST(test_apply_correctness_verification);
 
     return UNITY_END();
 }