MDEV-35940 Unallowed state transition: donor -> synced in galera_wan

[plampio]

Problem

In a debug build, galera.galera_wan (and galera_vote_rejoin_ddl) can abort with:

server: unallowed state transition: donor -> synced
Assertion `0' failed. // wsrep-lib/src/server_state.cpp:1371

The donor exit path is donor -> joined -> synced. The donor -> joined step is synthesized in sst_sent() / return_from_donor_state() because the v26 provider API has no JOINED event. But the provider's SYNCED callback (on_sync()) can arrive before sst_sent() runs, while the server is still s_donor, and the post-init branch of on_sync() then attempts the forbidden donor -> synced.

It is a race between two threads, serialized by server_state::mutex_ for atomicity but not for ordering:

• donor SST thread (sst_donor_thread) → sst_sent() →
  return_from_donor_state() → donor -> joined
• provider receive thread (wsrep_->recv()) → synced_cb →
  on_sync() → ... -> synced

Fix

In the post-init branch of on_sync(), anticipate JOINED before going to synced, reusing the existing helper (mirrors what the initial-sync branch already does):

if (state_ == s_donor)
{
    return_from_donor_state(lock);   // donor -> joined
}
if (state_ != s_synced && state_ != s_disconnecting)
{
    state(lock, s_synced);           // joined -> synced
}

return_from_donor_state() only acts when state == s_donor, so it is a no-op in every other case.

Testing

• New wsrep-lib unit test server_state_sst_first_sync_on_donor: drives start_sst (→ donor) then on_sync(), asserting it ends in synced. Reaching synced proves it routed through joined, since the state machine forbids a direct hop.
• Verified the test aborts without the fix (SIGABRT at server_state.cpp:1371) and passes with it; full wsrep-lib suite green (162 cases).