feat: ha_should_redirect + join.c HA redirect/nomaster guard (P1-6)

Add redirect helpers to ha.c/ha.h so a standby controller never accepts
join requests as if it were the primary:

- ha_should_redirect(): returns 1 when role is STANDBY and primary_host/port
  are known — caller should send E_XCE_REDIRECT.
- ha_no_primary_known(): returns 1 when role is STANDBY but primary address
  is not yet known — caller should send E_XCE_NOMASTER (retry later).
- Add E_XCE_NOMASTER and E_XCE_REDIRECT to errnox.h.
- Wire both guards into handle_join_() in join.c (before the role switch)
  so all join types (worker, scheduler, apiserver, client) are protected.
- Full redirect response sends status=-E_XCE_REDIRECT with nodata body;
  the primary host:port are logged so operators can trace misrouted clients.
  Full Cap'n Proto RedirectInfo response body is deferred to a follow-up
  (schema union would require regenerating capnp bindings).

5 new TDD tests — 110 total, 0 failures.

src/controller/ha.h

@@ -141,4 +141,21 @@ void ha_stop_watchdog(ha_state_t *ha);
  */
 void ha_check_heartbeat_nocluster(ha_state_t *ha);
 
+/* ── Redirect helpers used by join.c ──────────────────────── */
+
+/*
+ * ha_should_redirect: returns 1 if this controller should redirect join
+ * requests to the primary.
+ * Returns 0 if: (a) role is PRIMARY, or (b) primary_host is empty /
+ * primary_port is 0 (no primary known yet — client should retry).
+ */
+int ha_should_redirect(const ha_state_t *ha);
+
+/*
+ * ha_no_primary_known: returns 1 if role is STANDBY and primary_host is
+ * empty or primary_port is 0.  Caller should reply E_XCE_NOMASTER so the
+ * client knows to retry later rather than treating the error as permanent.
+ */
+int ha_no_primary_known(const ha_state_t *ha);
+
 #endif /* HA_H */