feat: P3-7 ctrl_metrics — 7 atomic counters/gauges + descriptor table + persist wiring

Add operational metrics infrastructure for the XCE controller persistence
and HA subsystems (design doc P3-7, review A8-007).

- src/include/ctrl_metrics.h: declares 7 _Atomic uint64_t metrics with
  ctrl_ prefix, CTRL_METRIC_INC / CTRL_METRIC_SET macros, ctrl_metric_desc_t
  descriptor struct, ctrl_metric_descriptors[] table, and ctrl_metrics_init()
- src/controller/ctrl_metrics.c: defines the 7 counters/gauges, the
  descriptor table (7 entries + NULL sentinel), and ctrl_metrics_init()
- src/controller/persist.c: #include ctrl_metrics.h; call ctrl_metrics_init()
  at persist_start() entry; CTRL_METRIC_INC(ctrl_repl_degraded_count) when
  repl_wait_ack returns < 0 (degraded / local-only durability mode)
- src/controller/meson.build: add ctrl_metrics.c to xce_controller and
  controller_unit_test source lists; add test_ctrl_metrics.c to test sources
- src/controller/testsuite/test_ctrl_metrics.c: 5 TDD-first Unity tests
  covering init-zeros, increment, set/overwrite gauge, descriptor sentinel
  count, and transient-stuck counter accumulation — all PASS

src/controller/ctrl_metrics.c

@@ -0,0 +1,68 @@
+/*
+ * ctrl_metrics.c — P3-7: Operational metrics for the XCE controller.
+ *
+ * Defines the 7 atomic counters/gauges and the descriptor table used
+ * for metric discovery.  All variables are initialised to 0 at program
+ * start (C guarantees this for file-scope variables), and are zeroed
+ * explicitly by ctrl_metrics_init() which is called from persist_start()
+ * so that tests can call it repeatedly without interference.
+ */
+#include "ctrl_metrics.h"
+
+#include <stdatomic.h>
+#include <stddef.h>
+#include <stdint.h>
+
+/* ── Counter/gauge definitions ──────────────────────────────────────── */
+_Atomic uint64_t ctrl_repl_degraded_count    = 0;
+_Atomic uint64_t ctrl_split_brain_detected   = 0;
+_Atomic uint64_t ctrl_async_events_lost      = 0;
+_Atomic uint64_t ctrl_transient_jobs_stuck   = 0;
+_Atomic uint64_t ctrl_wal_bytes              = 0;
+_Atomic uint64_t ctrl_checkpoint_duration_ms = 0;
+_Atomic uint64_t ctrl_repl_lag_lsn           = 0;
+
+/* ── Descriptor table ───────────────────────────────────────────────── */
+const ctrl_metric_desc_t ctrl_metric_descriptors[] = {
+    { "ctrl_repl_degraded_count",
+      &ctrl_repl_degraded_count,
+      "Sync replication fallbacks to local-only durability",
+      1 },
+    { "ctrl_split_brain_detected",
+      &ctrl_split_brain_detected,
+      "Term conflicts indicating split-brain risk",
+      1 },
+    { "ctrl_async_events_lost",
+      &ctrl_async_events_lost,
+      "Async WAL entries lost during failover",
+      1 },
+    { "ctrl_transient_jobs_stuck",
+      &ctrl_transient_jobs_stuck,
+      "TRANSIENT jobs auto-terminated after timeout",
+      1 },
+    { "ctrl_wal_bytes",
+      &ctrl_wal_bytes,
+      "Current WAL size in bytes",
+      0 },
+    { "ctrl_checkpoint_duration_ms",
+      &ctrl_checkpoint_duration_ms,
+      "Duration of last checkpoint in milliseconds",
+      0 },
+    { "ctrl_repl_lag_lsn",
+      &ctrl_repl_lag_lsn,
+      "LSN gap between primary and slowest standby",
+      0 },
+    { NULL, NULL, NULL, 0 }  /* sentinel */
+};
+
+/* ── ctrl_metrics_init ──────────────────────────────────────────────── */
+void ctrl_metrics_init(void)
+{
+    atomic_store_explicit(&ctrl_repl_degraded_count,    0, memory_order_relaxed);
+    atomic_store_explicit(&ctrl_split_brain_detected,   0, memory_order_relaxed);
+    atomic_store_explicit(&ctrl_async_events_lost,      0, memory_order_relaxed);
+    atomic_store_explicit(&ctrl_transient_jobs_stuck,   0, memory_order_relaxed);
+    atomic_store_explicit(&ctrl_wal_bytes,              0, memory_order_relaxed);
+    atomic_store_explicit(&ctrl_checkpoint_duration_ms, 0, memory_order_relaxed);
+    atomic_store_explicit(&ctrl_repl_lag_lsn,           0, memory_order_relaxed);
+}