feat(raft-drive-async): peer-control vtask dispatch shim, dormant (task 3.1)

Lands the PeerCtrlDispatch machinery behind a DEFAULT-OFF flag
(g_drive_async_peerctrl_dispatch_enabled); production behavior is
UNCHANGED. peer_ctrl_msg_handler becomes a thin shim that takes
ownership of ep->fsm_in.pkt and either runs the routing body inline
(flag OFF, byte-for-byte the prior path) or dispatches it to the vtask
pool via vtask_enq_classified (flag ON). The 3 routers now take pkt as
an explicit param (no cross-thread ep->fsm_in.pkt re-read). Per-endpoint
arrival order is enforced by bind_vtask's endpoint_block_tasks.

Packet ownership: shim clears ep->fsm_in.pkt at dispatch (sole-owner
transfer); peer_ctrl_vtask_entry NULLs iod->pkt before the body frees
it once. New vtask_t.owns_io_pkt (default 0) lets taskq_item_killer free
the carried packet for an un-executed queued task at vtaskmgr_fini WITHOUT
double-freeing the libxce endpoint-owned path (bug-1199).

Adversarial review found two FLAG-ON hazards, documented with loud
comments (flag is OFF so production is unaffected), to be resolved before
task 3.4 flips the flag ON:
  - bug-1197 (CRITICAL): raft_cb_become_follower endpoint_fini()s peer
    vote-eps from a pool worker, racing the io_worker's read of ep->data;
    needs iomgr_unmonitor before endpoint_fini in every pool-reachable
    teardown.
  - bug-1198 (HIGH): peer_ctrl_classify tags all work VTASK_LIVENESS, but
    the CTRL_PRIMARY repl-ack path can run a blocking snapshot checkpoint
    inline; resolved by task 3.2 (offload snapshot to SlowLane).

Per spec, 3.1 is not 'done' until the task 3.4 deadlock gate is green.
Tests: 3 new peerctrl tests; controller 196/196, lib 282/0; 0 net leaks.

src/include/vtaskmgr.h

@@ -48,6 +48,16 @@ typedef struct {
     int           vcpu;
     vtask_func_t  entry;
     vtask_class_t cls;  /* LivenessAdmission class (task 1.6); default LIVENESS */
+    /* raft-drive-async task 3.1: when non-zero AND data->vtype == VTASK_IO, the
+     * carried io_packet_t (data->u.iodata.pkt) is OWNED by the task and must be
+     * freed by taskq_item_killer if the task is destroyed while still queued
+     * (never executed) at vtaskmgr_fini.  Default 0 preserves the legacy
+     * endpoint-owned-packet model used by the libxce client path (xcectx.c's
+     * vtask_handle_msg does NOT clear ep->fsm_in.pkt, so the packet lifetime is
+     * tied to the endpoint, not the task — freeing it here would double-free).
+     * The controller's peer-control dispatch sets this to 1 because it clears
+     * ep->fsm_in.pkt and the task becomes the sole owner. */
+    int           owns_io_pkt;
 } vtask_t;
 
 #define ITPTR_TO_VTASK(p) ((vtask_t*)(((char*)p) - offsetof(vtask_t, link)))