Engine: warm standby part 3, promotion with a fenced writer epoch (EN-12) #285

Part 3 of 4 of EN-12 (#264). Builds on part 1 (#283) and part 2 (sync shipping).

Goal. Promote a follower to primary on failover, with a fenced writer epoch so a deposed primary can never commit again.

Scope.

• A durable writer epoch per data directory (replication/epoch), carried on every stream frame, heartbeat and write reply.
• POST /v1/replication/promote {epoch} (admin or the cell controller). The follower stops tailing, persists the epoch, raises its logical time above the newest primary revision it applied (so revisions keep increasing for clients), and becomes writable.
• Lease-gated commits: a primary commits only while it holds an unexpired lease for its epoch. The controller promotes only after the lease expires plus a margin, so a partitioned old primary stops writing before a new one starts.
• A node that sees a higher epoch anywhere (a follower hello, a heartbeat, a controller call) becomes read-only at once. Followers refuse streams from a lower epoch.
• A returning old primary starts read-only and rejoins as a follower through resync. Its unshipped tail is discarded.
• Subscriptions after failover: clients reconnect to the new primary through the service address. The existing epoch-scoped reconnect cursor is refused, so the client re-subscribes from a fresh snapshot, and nothing from the old primary's log is replayed.

Done when. Tests cover promote, a fenced old primary refusing writes, old-primary rejoin, and split-brain under partition (the old primary's lease expires before promotion).