feat(inkless:switch): add operator recovery for a phase 1 partition that lost its classic prefix [KC-717] - #855

In phase 1 of the classic-to-diskless switch, the part of the classic prefix that the remote log manager hasn't copied yet exists only on the replicas' local disks. If every ISR member loses its local log, the partition remains offline:

• The broker takes the partition offline because the leader's log ends below the seal.
• The controller elects only ISR members, and KC-636 blocks unclean leader election.
• Only a leader with the whole prefix requests classicPrefixInRemoteStorage, which starts phase 2.

A topic with a replication factor of 1 hits this case when its only replica loses its disk. Deleting the topic is the only way out, and that also drops its diskless data.

This change adds the smallest controller overrides that unblock the partition, and leaves the inspection of replicas and remote storage to the operator.

Changes

• Elect: the LeaderId field on AlterDisklessSwitch elects a replica even if it's outside the ISR, and sets the ISR to that replica alone. The controller requires a committed seal, an active replica other than the leader, and an online log directory. kafka-topic-switch.sh elect sends it, and rejects a negative --replica before it reads the partition.
• Start phase 2: the ClassicPrefixInRemoteStorage and LastClassicLeaderEpoch fields set the flag and lastClassicLeaderEpoch from fix(inkless:switch): recreate phase 2 replicas that don't hold the committed classic prefix [KC-702] #857, and lower the seal to SealOffset in the same record. The controller accepts a seal from 0 to the committed seal. It rejects the same out-of-range epochs as for SetClassicPrefixInRemoteStorage. kafka-topic-switch.sh start-phase-2 sends it, and reminds the operator to run repair when the seal drops.
• Version: the three fields are new in version 1 of AlterDisklessSwitch, and the request builder rejects them at version 0. Against a broker or controller that supports only version 0, the commands fail before they send anything. Otherwise, the controller would ignore the fields, run a plain seal override, and report success.
• Transactions: a lowered seal can cut a transaction off from its marker. Diskless storage can't complete that transaction, so the last stable offset would stop below the seal, which stalls read_committed reads and remote uploads. The tier-state machine starts the producer state empty at the seal when the snapshot it restores has an open transaction. The check from fix(inkless:switch): recreate phase 2 replicas that don't hold the committed classic prefix [KC-702] #857 recreates a kept log at or past the seal that has an open transaction from below the seal, and the replica rebuilds the same way.
• Prune: the control plane caps the WAL prune keep offset at highestOffsetInRemoteStorage + 1 (migration V32). After a lowered seal, the WAL has no batches between the end of remote storage and the first diskless batch. Without the cap, the prune moves the WAL start past the lost range, and a leader that rebuilds from remote storage truncates onto it.
• Docs: CLASSIC_TO_DISKLESS_SWITCH.md gets a runbook. It reads the replica's high watermark from replication-offset-checkpoint, and the new seal and epoch from __remote_log_metadata. After an unclean leader election, it checks the replica's leader-epoch-checkpoint too, because the high watermark doesn't prove that the replica has the committed prefix. DISKLESS_CONSOLIDATION.md describes the prune cap.

The controller rejects mixed options: LeaderId with ClassicPrefixInRemoteStorage, either one with ClearProducerStates, and LastClassicLeaderEpoch without the flag.

Limitations

• The commands don't inspect replica logs or remote storage. The operator picks the replica, the new seal, and the epoch. A wrong epoch makes replicas fail the check from fix(inkless:switch): recreate phase 2 replicas that don't hold the committed classic prefix [KC-702] #857 and rebuild, and phase 2 can't be undone.
• A broker that took the partition offline ignores the recovery until it restarts.
• If the elected replica's log ends below the seal, the broker takes the partition offline again, and the operator elects another replica.
• start-phase-2 brings back a leader with an incomplete prefix only on a topic with remote storage and consolidation.
• A transaction whose marker was in the lost range has no outcome. read_committed consumers receive its records below the new seal.
• A follower below a lowered seal keeps such a transaction when it catches up to the seal. The check runs again on the next leader epoch, including the one in which the follower becomes the leader.

Testing

• RecoverPhaseOnePartitionTests in ReplicationControlManagerInklessTest covers both actions and each rejection. testClassicPrefixFlagWritesLoweredSeal in PartitionChangeBuilderTest checks the lowered seal in the flag record.
• testAlterDisklessSwitchRequestV0FailsWithRecoveryFields in RequestResponseTest checks that version 0 rejects each recovery field. The serialization tests round-trip them at version 1.
• testTierStateMachineDropsTransactionWithoutMarkerBelowSeal and testSwitchedLeaderInPhaseTwoRecreatesReplicaWithTransactionWithoutMarker in ReplicaManagerInklessTest cover the rebuild and the recreated log, each against a completed transaction.
• TopicSwitchCommandTest covers elect and start-phase-2: the requests, the dry runs, the phase checks, the offset range, and a negative replica.
• handoffBelowLostRangeKeepsWalStartAtRemoteEnd in AbstractControlPlaneTest covers the prune cap on the in-memory and Postgres control planes.
• ReplicationControlManagerInklessTest, PartitionChangeBuilderTest, TopicSwitchCommandTest, ReplicaManagerInklessTest, InMemoryControlPlaneTest, PostgresControlPlaneTest, and RequestResponseTest pass. Checkstyle passes on clients, core, metadata, and tools, and spotbugs on clients, metadata, and tools.
• No cluster test or system test runs both actions end to end.
• python3 .vale/inkless.py --base origin/giuseppelillo/kc-702-epoch-rework doesn't report any alerts.

Assisted-by: Claude Opus 5.5