Engine: warm standby part 2, synchronous shipping with RPO 0 (EN-12) #284

Part 2 of 4 of EN-12 (#264). Part 1 (WAL streaming to a follower that applies and stays consistent, asynchronous shipping) is #283.

Goal. Synchronous shipping: a commit is acknowledged only after a follower has applied it durably, so the RPO is zero for every acknowledged write while a sync follower is attached.

Scope.

• replication.mode = "async" | "sync" on the primary. In sync mode a commit's reply waits until a follower acks its LSN. Followers already ack each applied frame after one WAL fsync.
• replication.sync_timeout_ms and on_follower_loss = "block" | "degrade":
  • block: writes wait, then fail with a timeout, so RPO stays 0 and availability drops.
  • degrade: fall back to async with an alert, and re-arm once a follower catches up.
• The commit is already durable on the primary when the wait times out, so a timeout is reported as "not confirmed on a replica", never as a failed commit.
• Replication lag and the sync state on /metrics and /metrics/prometheus.
• Measure the commit latency cost of sync mode, and RPO in both modes, on the perf gate host.

Done when. A kill-the-primary test in sync mode loses no acknowledged write; the latency cost is measured and documented; async mode latency is unchanged.