Fix MergeSeen to filter Seen against current Members (#8009)

[Aaronontheweb]

Problem

ClusterMessageSerializer.GossipToProto throws ArgumentException: Unknown address when Seen contains addresses not present in Members.

Root Cause

The gossip protocol lacks tombstones for removed members. Without tombstones, removed members can be reintroduced during gossip merging, and their Seen entries persist after the member is removed from Members.

The MergeSeen method performed a blind union of seen sets without filtering against current membership.

Solution

Apply defensive fix to MergeSeen that ensures the invariant Seen ⊆ Members is always maintained:

public Gossip MergeSeen(Gossip that)
{
    var memberAddresses = _members.Select(m => m.UniqueAddress).ToImmutableHashSet();
    var mergedSeen = _overview.Seen.Union(that._overview.Seen).Intersect(memberAddresses);
    return Copy(overview: _overview.Copy(seen: mergedSeen));
}

Characteristics

• Zero breaking changes
• Wire-compatible with all existing versions
• Defense-in-depth against corruption from any source
• Minimal performance impact

Future Work

A more comprehensive fix using tombstones is planned for 1.6.0 - see #8015.

Closes #8009