LeaderAuthority

The §5.2/§8 leader-authority gate (#1383, #1889): the sender is not in ourVoters, and only a voter can be leader, so a leader→peer RPC from it is treated as a forgery.

On an honest wedge (#1898) ourVoters is simply stale — this node was absent across a voter-set rotation, and the frames that would teach it the new set are precisely the ones it refuses, because they come from senders the old set does not contain. The stale set is the thing preventing its own repair, and it is persisted, so restarting does not clear it.