Swap a mobile voter back to a stable standby once one is fit #221

A swap fires only when a voter is unfit, so a standby that recovers stays a standby, and a mobile host that took a vote keeps it until it becomes unfit.

Change: give each host a declared stability, stable by default and mobile for a laptop an operator also uses, and make it a term in the candidate rank. Add one decision, return: when no voter is unfit, the gates are open and the cooldown has passed, and a voter is mobile while a stable standby is fit and ranks above it, swap them. Hysteresis comes from the existing cooldown after a membership change, so a flapping host cannot cause repeated swaps; the target count is never crossed.

Validation: a scenario where a mobile voter holds a vote, a stable standby becomes fit, and the swap runs once; a scenario inside the cooldown where nothing runs; unit tests over the decision. Each change is broken once to see a test fail.

Depends on treating a host that is in use or leaving as unfit. Part of the presence-driven regrading epic (#223).