fix(relay): skip boot-time DDL when the catalog already has the object (#21147)

* fix(relay): skip boot-time DDL when the catalog already has the object

CREATE INDEX IF NOT EXISTS and ALTER TABLE ADD COLUMN IF NOT EXISTS take
their relation lock before the server evaluates the existence test, so a
boot on an already-migrated database still joins the lock queue. Relation
locks are granted in queue order, so every writer queues behind it.

The shared runner now asks pg_catalog whether the index or column is
already there and skips the statement when a row comes back, and 55P03
is no longer retried by default: with the pre-check ahead of it, a lock
timeout means the object is genuinely missing and each retry re-enters
the queue. Push keeps the old retry behind an explicit option.

* fix(relay): tie the index pre-check to its table and fail on an unreadable target

Three defects found in review of the auth reference implementation:

- The catalog query matched an index by name inside the table's namespace
  without checking it belonged to that table. Index names are unique per
  schema, not per table, so a same-named index on a sibling table answered
  yes and the real index was skipped forever. Added i.indrelid = t.oid.
- Lock-target derivation read a keyword sitting in an identifier position as
  the object name: CREATE UNIQUE INDEX CONCURRENTLY ON t(c) yielded the name
  CONCURRENTLY, and ADD COLUMN IF NOT EXISTS with no column yielded IF. A
  wrong target is worse than none, so keywords are now excluded and an index
  or column statement whose target cannot be read throws at boot with the
  statement text instead of falling through to the lock path.
- A concurrent-create collision retried the CREATE INDEX, taking SHARE on the
  table again for an object another director had just finished creating. The
  catalog is re-asked instead and a present object counts as skipped.

* fix(relay): pre-check constraint swaps so a warm boot sends no DDL at all

The two ALTER TABLE constraint statements were the last lock-taking
statements without a pre-check, so every boot still took ACCESS EXCLUSIVE
on relay_region_rehome_attempts twice.

A lock target now carries the catalog answer that means there is nothing
left to do. ADD CONSTRAINT skips when pg_constraint already names it; DROP
CONSTRAINT IF EXISTS is the inverse and skips when it does not, because
nothing to drop is nothing to do. The match is by name only: the CHECK body
is generated from RELAY_REGIONS, so comparing it would re-run the swap on
every region change. Changing a definition under the same name is an
operator migration, and the rule comment beside SCHEMA says so.

A bare DROP CONSTRAINT gets no target and throws at boot, because skipping
it would swallow the undefined_object the server is supposed to raise.

The census invariant is now that every lock-taking statement has a
pre-check, with no exceptions, and the warm-boot Postgres test asserts zero
statements sent rather than two.

* fix(relay): refuse a multi-action ALTER TABLE instead of pre-checking its first action

`ALTER TABLE t ADD COLUMN IF NOT EXISTS a TEXT, ADD COLUMN IF NOT EXISTS b
TEXT` derived the target for `a` alone, so once `a` existed the whole
statement was skipped and `b` was never added. The first subcommand parses,
so neither the parse throw nor the census caught it.

A lock-taking ALTER TABLE with a comma outside parentheses, quotes and
comments now throws at boot. One action per statement, or no pre-check is
possible. Commas inside a parenthesised type, a CHECK body, a quoted
default or a comment are unaffected, and push's 18 statements still parse.

* fix(relay): strip every comment before classifying, fold catalog names, count brackets

Four findings from the bot reviews on #21147:

- A comment between two keywords (ALTER TABLE t ADD /* note */ COLUMN c
  TEXT) was invisible to both the classification regexes and the must-parse
  shapes, so the statement got no target AND no throw and ran with no
  pre-check. Every comment is now stripped quote-aware before classification,
  nested block comments included. The server is still sent the original text.
- hasTopLevelComma counted parentheses but not square brackets, so
  ADD COLUMN c bigint[] DEFAULT ARRAY[1, 2] read as two subcommands and
  failed the boot.
- bareIdentifier split a qualified name on '.' regardless of quoting, so
  "a.b" became b", and it kept the written case while Postgres folds an
  unquoted identifier to lower case before storing it in relname, attname
  and conname. The name is now tokenised quote-aware and folded, with the
  qualified table text still passed to to_regclass as written.
- sqlWithoutLeadingComments is renamed sqlWithoutComments to match.

Relay's 74 statements and push's 18 all still parse, and no relay target
name changed: every identifier there was already lower case.

* fix(relay): treat a dollar-quoted body as opaque in both scanners

A comment marker, comma, parenthesis or bracket inside `$$...$$` or
`$tag$...$tag$` is text. The closing delimiter has to match the opening tag
exactly, so an inner `$$` inside a `$tag$` body is more text rather than the
end, and a tag cannot start with a digit, which keeps a `$1` placeholder
from reading as an opener.

Relay's pg_stat_statements DO block is the only dollar-quoted statement in
the schema, and it now survives the stripper byte-identical. A test asserts
that against the real statement.

cloud/apps/relay/src/database-statement-timeout-postgres.test.ts

@@ -42,10 +42,12 @@ describePostgres('PostgreSQL statement deadline', () => {
     expect(result).toBe(2)
   }, 15_000)
 
-  // Why: DDL runs on its own untimed connection. relay_invites carries a
-  // CREATE INDEX IF NOT EXISTS, which (unlike CREATE TABLE IF NOT EXISTS)
-  // really does queue behind an ACCESS EXCLUSIVE lock on the table.
-  it('applies the schema behind a held ACCESS EXCLUSIVE lock', async () => {
+  // Why: relay_invites carries a CREATE INDEX IF NOT EXISTS, which (unlike CREATE TABLE IF NOT
+  // EXISTS) really does queue behind an ACCESS EXCLUSIVE lock on the table. The catalog pre-check
+  // asks pg_class whether that index is already there, and the read takes no lock on relay_invites,
+  // so a boot on a migrated database no longer joins the queue at all. It used to, and every writer
+  // queued behind it in lock order.
+  it('boots without queueing behind a held ACCESS EXCLUSIVE lock', async () => {
     let releaseTable!: () => void
     const tableReleased = new Promise<void>((resolve) => {
       releaseTable = resolve
@@ -61,7 +63,9 @@ describePostgres('PostgreSQL statement deadline', () => {
     })
     await tableHeldPromise
 
-    const opening = openRelayDatabase({
+    // Resolving while the lock is still held is the whole proof: a statement that queued would hit
+    // the schema connection's 1s lock_timeout and fail the boot, which is no longer retried.
+    const database = await openRelayDatabase({
       databaseUrl,
       dataDir: '',
       applicationName,
@@ -69,27 +73,18 @@ describePostgres('PostgreSQL statement deadline', () => {
       // connection must not.
       statementTimeoutMs: 200
     })
-    const blockedOnSchemaConnection = async (): Promise<boolean> => {
-      const deadline = Date.now() + 4_000
-      while (Date.now() < deadline) {
-        const rows = await databases[0]!.query(
-          `SELECT count(*) AS waiting FROM pg_stat_activity
-           WHERE datname = current_database() AND wait_event_type = 'Lock'
-             AND application_name = ?`,
-          [`${applicationName}/schema`]
-        )
-        if (Number(rows[0]!.waiting) > 0) return true
-        await new Promise((resolve) => setTimeout(resolve, 10))
-      }
-      return false
-    }
-    const blocked = await blockedOnSchemaConnection()
+    databases.push(database)
+    const waiting = await databases[0]!.query(
+      `SELECT count(*) AS waiting FROM pg_stat_activity
+       WHERE datname = current_database() AND wait_event_type = 'Lock'
+         AND application_name = ?`,
+      [`${applicationName}/schema`]
+    )
+    expect(Number(waiting[0]!.waiting)).toBe(0)
+
     releaseTable()
     await holder
 
-    const database = await opening
-    databases.push(database)
-    expect(blocked).toBe(true)
     // The serving pool still carries the short deadline it was opened with.
     expect(await database.query(`SELECT current_setting('statement_timeout') AS statement_timeout`)).toEqual([
       { statement_timeout: '200ms' }