feat: P3-7 ctrl_metrics — 7 atomic counters/gauges + descriptor table + persist wiring

Add operational metrics infrastructure for the XCE controller persistence
and HA subsystems (design doc P3-7, review A8-007).

- src/include/ctrl_metrics.h: declares 7 _Atomic uint64_t metrics with
  ctrl_ prefix, CTRL_METRIC_INC / CTRL_METRIC_SET macros, ctrl_metric_desc_t
  descriptor struct, ctrl_metric_descriptors[] table, and ctrl_metrics_init()
- src/controller/ctrl_metrics.c: defines the 7 counters/gauges, the
  descriptor table (7 entries + NULL sentinel), and ctrl_metrics_init()
- src/controller/persist.c: #include ctrl_metrics.h; call ctrl_metrics_init()
  at persist_start() entry; CTRL_METRIC_INC(ctrl_repl_degraded_count) when
  repl_wait_ack returns < 0 (degraded / local-only durability mode)
- src/controller/meson.build: add ctrl_metrics.c to xce_controller and
  controller_unit_test source lists; add test_ctrl_metrics.c to test sources
- src/controller/testsuite/test_ctrl_metrics.c: 5 TDD-first Unity tests
  covering init-zeros, increment, set/overwrite gauge, descriptor sentinel
  count, and transient-stuck counter accumulation — all PASS

src/controller/persist.c

@@ -1,6 +1,7 @@
 #define _GNU_SOURCE
 #include "persist.h"
 #include "config.h"
+#include "ctrl_metrics.h"
 #include "hook.h"
 #include "xce/cluster_def.h"
 #include "xce/types.h"
@@ -179,6 +180,8 @@ int persist_init(persist_t* p, persist_config_t* cfg, cluster_t* c)
 
 int persist_start(persist_t* p)
 {
+    ctrl_metrics_init();
+
     /* Register AFTER_EVENT persistence hooks if we have a cluster back-pointer */
     if (p->cluster != NULL) {
         xce_add_hook(&p->cluster->hooksys, XCE_CONTROLLER_HOOK_JOB,
@@ -869,6 +872,8 @@ int persist_wal_sync_append(persist_t* p, uint32_t type,
 
     int sync_err = repl_wait_ack(&p->repl, written_lsn,
                                  p->config.sync_timeout_ms);
+    if (sync_err < 0)
+        CTRL_METRIC_INC(ctrl_repl_degraded_count);
     if (sync_rc_out)
         *sync_rc_out = sync_err;
     /* -ETIMEDOUT = degraded mode (local-only durability); -ENODEV = no standbys.