Preserve votes when term does not change

[cjen1-msft]

Summary

• fix same-term step-down so voted_for is only cleared when the observed term actually changes
• add a deterministic three-node Raft scenario covering the pre-vote double-leader path
• assert that the delayed second election is rejected, then converge the network for driver liveness

Why this fixes the violation

Pre-vote does not write voted_for, but it preserves any regular vote already cast in the current term. Previously, a same-term unmatched AppendEntries called become_aware_of_new_term() and erased that regular vote even though the term had not changed. This let the same node vote for two different candidates in term 3. Same term is not a new term, so the vote is now preserved; higher-term handling still clears it.

Validation

• old two-leader assertion goes red with Candidate != Leader and already voted for n[0]
• fixed scenario passed 20/20 repeated runs
• all Raft scenarios passed
• fixed scenario trace validation passed
• scripts/ci-checks.sh passed

[Copilot]

Pull request overview

This PR fixes a Raft election-safety bug in CCF’s AFT consensus implementation by ensuring voted_for is only cleared when the observed term actually changes (preventing double-voting within a single term). It also adds a deterministic Raft scenario to reproduce the prior double-leader path under pre-vote and assert the corrected behavior.

Changes:

• Preserve voted_for across same-term step-downs by conditionally clearing it only when current_view changes.
• Add a new 3-node deterministic Raft scenario that exercises the pre-vote double-leader path and asserts the delayed second election is rejected.
• Ensure the scenario converges back to liveness after the safety assertion by dropping pending messages and syncing.

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/consensus/aft/raft.h	Prevents clearing voted_for on same-term transitions by resetting it only when the term actually changes.
tests/raft_scenarios/pre_vote_double_leader	Adds a deterministic regression scenario to cover the pre-vote/delayed election path and assert single-leader safety in-term.