feat: P3-6 ha_trigger_manual_failover_for_test() shim + 3 failover cycle tests

Add test-only function ha_trigger_manual_failover_for_test() to exercise manual
failover state machine (demote → promote cycle) without requiring live cluster_t.

Test coverage:
- test_manual_failover_transitions_role_and_increments_term: Validates role
  transitions (PRIMARY → STANDBY → PRIMARY) and term monotonicity
- test_manual_failover_resets_hooks_registered: Confirms demotion resets the
  hooks_registered idempotency guard
- test_manual_failover_monotonic_term_across_multiple_cycles: Validates term
  remains monotonically increasing across 5 consecutive failover cycles

Implementation:
- Exposed only under #ifdef XCE_TESTING in ha.h
- Function body (6 lines): calls ha_do_demote() then ha_do_promote(); returns
  the new term value via atomic_load_explicit()
- Enables design validation (P3-6) without test-cluster infrastructure

All tests pass. Build clean.

src/controller/ha.c

@@ -105,6 +105,17 @@ void ha_do_demote(ha_state_t *ha)
      * because it needs the cluster's hooksys_t. */
 }
 
+/* ── P3-6: Test-only failover shim ────────────────────────────── */
+
+#ifdef XCE_TESTING
+uint64_t ha_trigger_manual_failover_for_test(ha_state_t *ha)
+{
+    ha_do_demote(ha);
+    ha_do_promote(ha);
+    return atomic_load_explicit(&ha->term, memory_order_acquire);
+}
+#endif
+
 /* ── Watchdog thread implementation ────────────────────────── */
 
 void ha_check_heartbeat_nocluster(ha_state_t *ha)