feat(ha-commit-engine): per-LSN majority commit engine core (task 1.2)

commit_on_ack: active-standby (non-catch-up, connected) watermark scan,
descending sort, candidate arr[n_peers/2-1], clamped to appended log,
monotonic single-site committed_lsn store, condvar broadcast, never
blocks beyond engine mutex. RETAIN returns immediately. Self-quorum for
n_peers<=1; zero-fill makes zero-standby commit impossible. 7/7 task-1.1
tests green unmodified; full suite at known 3-failure baseline.

.kiro/specs/ha-commit-engine/tasks.md

@@ -10,7 +10,7 @@
   - Observable completion: build succeeds with the new header and test file; all new test cases FAIL (red) against a stub `commit.c` or unlinked implementation
   - _Requirements: 1.2, 2.1, 2.2, 2.3, 5.1_
 
-- [ ] 1.2 Implement the commit engine core to green
+- [x] 1.2 Implement the commit engine core to green
   - Create `src/controller/commit.c` (add to meson controller sources): `commit_engine_init`/`commit_engine_fini` (validate args, one mutex + one condvar), `commit_on_ack` (bounded scan of active standbys' `acked_lsn` into the scratch array, sort descending, candidate = `arr[n_peers/2 - 1]` clamped to appended log, monotonic `max()` store into `persist->committed_lsn`, condvar broadcast — never blocks), `commit_submit(RETAIN)` immediate return
   - Catch-up standbys (`in_catch_up`) excluded from the evaluation count (umbrella-locked conservative rule)
   - XCE_TESTING asserts for monotonicity