feat(raft): implement joint consensus for safe two-phase membership changes

Adds BeginJointConsensus, CommitJointConsensus, and CalculateJointQuorum to
RaftNode per Raft paper Section 4. During a joint configuration transition
quorum requires majority from BOTH Cold and Cnew; CommitJointConsensus
finalizes Cnew as the sole active configuration. The existing single-phase
ProposeAddPeerAsync/ProposeRemovePeerAsync are unchanged. Includes 16 new
tests covering flag behaviour, quorum boundaries, idempotent commit, and
backward-compatibility with the existing membership API.

src/NATS.Server/Raft/RaftNode.cs

@@ -23,6 +23,13 @@ public sealed class RaftNode : IDisposable
     // Go reference: raft.go:961-1019 (proposeAddPeer / proposeRemovePeer, single-change invariant)
     private long _membershipChangeIndex;
 
+    // Joint consensus (two-phase membership change) per Raft paper Section 4.
+    // During the joint phase both the old config (Cold) and new config (Cnew) are stored.
+    // A quorum decision requires majority from BOTH configurations simultaneously.
+    // Go reference: raft.go joint consensus / two-phase membership transitions.
+    private HashSet<string>? _jointOldMembers;
+    private HashSet<string>? _jointNewMembers;
+
     // Pre-vote: Go NATS server does not implement pre-vote (RFC 5849 §9.6). Skipped for parity.
 
     public string Id { get; }
@@ -54,6 +61,19 @@ public sealed class RaftNode : IDisposable
     // Go reference: raft.go:961-1019 single-change invariant.
     public bool MembershipChangeInProgress => Interlocked.Read(ref _membershipChangeIndex) > 0;
 
+    /// <summary>
+    /// True when this node is in the joint consensus phase (transitioning between
+    /// two membership configurations).
+    /// Go reference: raft.go joint consensus / two-phase membership transitions.
+    /// </summary>
+    public bool InJointConsensus => _jointNewMembers != null;
+
+    /// <summary>
+    /// The new (Cnew) member set stored during a joint configuration transition,
+    /// or null when not in joint consensus. Exposed for testing.
+    /// </summary>
+    public IReadOnlyCollection<string>? JointNewMembers => _jointNewMembers;
+
     public RaftNode(string id, IRaftTransport? transport = null, string? persistDirectory = null)
     {
         Id = id;
@@ -273,6 +293,62 @@ public sealed class RaftNode : IDisposable
         return entry.Index;
     }
 
+    // Joint consensus (Raft paper Section 4) — two-phase membership transitions.
+    // Go reference: raft.go joint consensus / two-phase membership transitions.
+
+    /// <summary>
+    /// Enters the joint consensus phase with the given old and new configurations.
+    /// During this phase quorum decisions require majority from BOTH configurations.
+    /// The active member set is set to the union of Cold and Cnew so that entries
+    /// are replicated to all nodes that participate in either configuration.
+    /// Go reference: raft.go Section 4 (joint consensus).
+    /// </summary>
+    public void BeginJointConsensus(IReadOnlyCollection<string> cold, IReadOnlyCollection<string> cnew)
+    {
+        _jointOldMembers = new HashSet<string>(cold, StringComparer.Ordinal);
+        _jointNewMembers = new HashSet<string>(cnew, StringComparer.Ordinal);
+        // The active member set is the union of both configs
+        foreach (var member in cnew)
+            _members.Add(member);
+    }
+
+    /// <summary>
+    /// Commits the joint configuration by finalizing Cnew as the active member set.
+    /// Clears both Cold and Cnew, leaving only the new configuration.
+    /// Call this once the Cnew log entry has reached quorum in both configs.
+    /// Go reference: raft.go joint consensus commit.
+    /// </summary>
+    public void CommitJointConsensus()
+    {
+        if (_jointNewMembers == null)
+            return;
+
+        _members.Clear();
+        foreach (var m in _jointNewMembers)
+            _members.Add(m);
+
+        _jointOldMembers = null;
+        _jointNewMembers = null;
+    }
+
+    /// <summary>
+    /// During joint consensus, checks whether a set of acknowledging voters satisfies
+    /// a majority in BOTH the old configuration (Cold) and the new configuration (Cnew).
+    /// Returns false when not in joint consensus.
+    /// Go reference: raft.go Section 4 — joint config quorum calculation.
+    /// </summary>
+    public bool CalculateJointQuorum(
+        IReadOnlyCollection<string> coldVoters,
+        IReadOnlyCollection<string> cnewVoters)
+    {
+        if (_jointOldMembers == null || _jointNewMembers == null)
+            return false;
+
+        var oldQuorum = (_jointOldMembers.Count / 2) + 1;
+        var newQuorum = (_jointNewMembers.Count / 2) + 1;
+        return coldVoters.Count >= oldQuorum && cnewVoters.Count >= newQuorum;
+    }
+
     // B5: Snapshot checkpoints and log compaction
     // Go reference: raft.go CreateSnapshotCheckpoint, DrainAndReplaySnapshot