[alex-zaitsev]

Scope

Stacked on #2114. The Raft safety planner is enabled by default on this branch, so the existing e2e harness needs no operator-installation environment-variable support.

• PlanAdmission is authoritative for staged 1→N / 2→3 admission. The existing preliminary exclusion, ConfigMap publication immediately before STS create, rollback, and stop behavior remain.
• CheckDisruption is authoritative inside the existing quorum wait, including after live readiness refresh.
• Unknown admission state or inconsistent quorum counts fail closed.
• Additional tests assert the no-env default, explicit fallback, and safe admission/disruption outcomes.

Run e2e normally

Build/deploy the operator from refactor/chk-raftplan-authoritative-20261022, then run the existing e2e workflow unchanged. The planner activates with no environment variables and no Helm/chart edits.

For optional manual rollback only, CHOP_CHK_RAFTPLAN_ENFORCE=0 restores the previous legacy decisions. The e2e suite does not need to set it.

Recommended scenarios

1. 1→3: next joiner held while previous joiner is unready.
2. Operator restart during first admission and ambiguous STS create.
3. Degraded 3-member quorum during rolling updates.
4. 2→3, 3→5, stop/resume, and scale-down regression.
5. Confirm no membership flapping and no unplanned existing-peer restarts.

Status and limitations

• Full e2e remains to be run by the test owner.
• No committed Keeper Raft membership verification is added.
• Existing membership settle delays and StatefulSet waiting behavior remain unchanged.
• This PR stays draft until CI and e2e validate the authoritative behavior.

Dependency

Stacked on #2114 (observer and shadow parity tests).