[4pt] Make first eventual failover decision disregard membership status

[rosik]

Proposal form @opomuc.

When we restart whole cluster with eventual failover enabled, it doesn't have time to sync membership status. As a result, every instance thinks he's the only one alive, and becomes a leader an all 100 instances do call init({is_master = true}).

Instead, every instance could make first appointments as in disabled mode, and make decisions immune for some time.