fix: Phase 20 T3 — add V2 promotion observability to FailoverDiagnostic

FailoverDiagnostic now carries V2PromotionEnabled and V2PromotionReady
fields. MasterServer.FailoverDiagnosticSnapshot() enriches the failover
state diagnostic with rollout gate visibility so operators can confirm
whether the master is on V1, V2, or V2-fail-closed-placeholder mode.

Update phase-20.md: document default=false rollout policy (safe default
until proto regen enables evidence RPC, then flip to default true).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

weed/server/master_block_failover.go

@@ -54,6 +54,8 @@ type FailoverVolumeState struct {
 // Volume-oriented: each entry describes one volume's failover state.
 // Aggregate counts are derived from the volume list.
 type FailoverDiagnostic struct {
+	V2PromotionEnabled   bool           // T3: whether durability-first V2 promotion is active
+	V2PromotionReady     bool           // T3: whether V2 evidence querier is wired (false = fail-closed placeholder)
 	Volumes              []FailoverVolumeState
 	PendingRebuildCount  map[string]int // dead server → count of pending rebuilds
 	DeferredPromotionCount map[string]int // dead server → count of deferred promotion timers
@@ -93,6 +95,15 @@ func (fs *blockFailoverState) DiagnosticSnapshot() FailoverDiagnostic {
 	return diag
 }
 
+// FailoverDiagnosticSnapshot returns a FailoverDiagnostic enriched with
+// V2 promotion rollout state so operators can observe the active mode.
+func (ms *MasterServer) FailoverDiagnosticSnapshot() FailoverDiagnostic {
+	diag := ms.blockFailover.DiagnosticSnapshot()
+	diag.V2PromotionEnabled = ms.blockV2Promotion
+	diag.V2PromotionReady = ms.blockV2Promotion && ms.blockVSQueryEvidence != nil
+	return diag
+}
+
 // PublicationDiagnostic is a bounded read-only snapshot comparing the
 // operator-visible publication (LookupBlockVolume response) against the
 // registry authority for one volume. P3 diagnosability surface for S2.