feat(ha-prevote): controller candidate-side PreVote orchestration (task 4.1)

ha.c: raft_cb_send_pre_vote_request (emits preVoteRequest), ha_start_prevote_async
(side-effect-free round + bounded round timeout), pre_vote_reply_dispatch
(raft_on_pre_vote_reply + branch), ha_enter_real_election helper. WON -> truncate
+ CTRL_ELECTING + ha_start_election_async (unchanged real-election path); LOST/
timeout -> stay CTRL_STANDBY + re-arm liveness + log abandonment; PENDING -> no-op.
Round inert until task 4.2 wires triggers; absolute peer-index keyed tally. 6 new
test_ha_prevote tests via reply hook; daemon + suite link clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/controller/ha.h

@@ -801,6 +801,25 @@ void ha_start_election_async(ha_state_t *ha, cluster_t *c,
                              uint64_t my_config_tag, uint64_t my_lsn,
                              const char *my_name);
 
+/*
+ * ha_start_prevote_async: start a side-effect-free PreVote round before any
+ * real election (ha-prevote task 4.1).
+ *
+ * Snapshots self tag/lsn, calls raft_begin_pre_vote (self-grant + per-peer
+ * preVoteRequest send), and arms a round timeout bounded by election_timeout_ms
+ * (Req 5.4).  The node stays CTRL_STANDBY and mutates NO persistent state
+ * (no term / voted_for / role change) for the duration of the round.  Replies
+ * are fed to the reply handler (pre_vote_reply_dispatch); on a majority WIN the
+ * unchanged real-election sequence runs (truncate + CTRL_ELECTING +
+ * ha_start_election_async), on a LOSS / round-timeout the node stays
+ * CTRL_STANDBY and re-arms the liveness watchdog.
+ *
+ * The failover triggers are rewired to call this in task 4.2; until then the
+ * round is inert in production.  c may be NULL in unit-test mode.
+ * Requirements: 1.1, 1.4, 1.5, 5.4, 7.3.
+ */
+void ha_start_prevote_async(ha_state_t *ha, cluster_t *c);
+
 /*
  * ha_dispatch_repl_action_for_standby: evaluate the replication decision for
  * one standby and execute the resulting action.