feat(ha-term-safety): retire term-0 repl_broadcast live send; carry leader term on replication (task 3.4)

Closes bug-990: the live replicator repl_broadcast wire-encoded term=0
(entry.term was never set), so standbys persisted hdr.term=0 and took the
legacy direct-apply path instead of the library (term,lsn) intake. Now the
live broadcast and catch-up streamer carry the leader's real term + AE prev
tuple; ha_apply_wal_catchup_entry routes every term-carrying entry through
raft_on_append_entries_request -> on_persist_entry (leader term stamped),
retiring the term-0 direct-apply. Standbys now persist the leader's real term
and reconcile by (term,lsn); the live commit chain is end-to-end.

848/849/850 + persist-before-ACK + commit-barrier + bug-960 preserved.
Proven at integration level; the definitive live STRICT_TERM failover run is
env-blocked here (bug-924 overlayfs) and recommended on a real fs.

src/controller/testsuite/test_repl_majority.c

@@ -279,7 +279,7 @@ static void test_broadcast_over_limit_removes_standby(void)
 
     /* Broadcast a wal entry — the over-limit standby should be evicted */
     wal_entry_hdr_t hdr = { .type = WAL_JOB_SUBMIT, .lsn = 1 };
-    int rc = repl_broadcast(&r, &hdr, NULL, 0);
+    int rc = repl_broadcast(&r, &hdr, NULL, 0, 0 /* prev_log_term */);
     /* repl_broadcast itself may return 0 even after eviction */
     (void)rc;