fix(cloud): pin the asia cell database pool in the same-cap plan validator (#21171)

* fix(cloud): pin the asia cell database pool in the same-cap plan validator

Raising `database_pool_max` from 10 to 16 for production-gce-c27, c28 and c29
made every same-cap roll of those three cells fail closed at plan validation.
The cell startup template emits `ORCA_RELAY_DATABASE_POOL_MAX` only for a cell
whose region differs from the root region or whose pool is off the default, so
the asia cells carry that line while the us-central1 cells do not. The plan
validator requires the before and after startup scripts to normalize to the
same text, masking only the lines it independently pins to a reviewed value.
The pool line was neither masked nor pinned, so the live template's `'10'` and
the plan's `'16'` were read as unreviewed drift.

The validator gains an optional `--database-pool-max`, accepted in
`same-cap-cell` mode alone. When it is supplied the after-script must contain
exactly that pool line and the line is masked from the equality check; when it
is not supplied the after-script must contain no pool line at all. Masking
without the pin would have removed the guard rather than moved it.

The same-cap job resolves the expected pool next to the hard cap, cross-checks
it against the committed `relay_gce_cells` map (asserting the default 10 for
the us-central1 cells), and passes the flag to both validator invocations only
for the cells that emit the line.

* test(cloud): require the pool pin for a line the live template already carries

.github/workflows/cloud-deploy-relay-production-same-cap-job.yml

@@ -213,10 +213,12 @@ jobs:
             c7|c8|c9|c10|c13|c14|c15|c16|c19|c20|c21|c22|c23|c24|c25|c26)
               EXPECTED_HARD_CAP=1000
               EXPECTED_REGION=us-central1
+              EXPECTED_DATABASE_POOL_MAX=
               ;;
             c27|c28|c29)
               EXPECTED_HARD_CAP=3000
               EXPECTED_REGION=asia-east2
+              EXPECTED_DATABASE_POOL_MAX=16
               ;;
             *) exit 1 ;;
           esac
@@ -236,6 +238,10 @@ jobs:
           test "$(jq -r '.connection_hard_cap' <<< "${CURRENT_SHAPE}")" = "${EXPECTED_HARD_CAP}"
           test "$(jq -r '.connection_unobserved_bound' <<< "${CURRENT_SHAPE}")" = \
             "${EXPECTED_UNOBSERVED_BOUND}"
+          # The startup script emits a pool line only off the root default, so an unpinned cell
+          # must still be on that default or its plan would carry a line nothing reviews.
+          test "$(jq -r '.database_pool_max' <<< "${CURRENT_SHAPE}")" = \
+            "${EXPECTED_DATABASE_POOL_MAX:-10}"
           TARGET_ZONE="$(jq -r '.zone' <<< "${CURRENT_SHAPE}")"
           MIG_NAME="orca-cloud-relay-gce-${TARGET_HOSTNAME}"
           if test "${DEPLOY_MODE}" = rollback; then
@@ -264,6 +270,7 @@ jobs:
             echo "MIG_NAME=${MIG_NAME}"
             echo "EXPECTED_HARD_CAP=${EXPECTED_HARD_CAP}"
             echo "EXPECTED_UNOBSERVED_BOUND=${EXPECTED_UNOBSERVED_BOUND}"
+            echo "EXPECTED_DATABASE_POOL_MAX=${EXPECTED_DATABASE_POOL_MAX}"
             echo "EXPECTED_REGION=${EXPECTED_REGION}"
             echo "DESIRED_IMAGE=${DESIRED_IMAGE}"
             echo "DESIRED_IMAGE_DIGEST=${DESIRED_IMAGE_DIGEST}"
@@ -461,6 +468,11 @@ jobs:
         env:
           DIRECTOR_RUNTIME_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_DIRECTOR_RUNTIME_SERVICE_ACCOUNT }}
         run: |
+          # A cell on the root pool default emits no pool line, so pin one only where it exists.
+          POOL_ARGUMENTS=()
+          if test -n "${EXPECTED_DATABASE_POOL_MAX}"; then
+            POOL_ARGUMENTS=(--database-pool-max "${EXPECTED_DATABASE_POOL_MAX}")
+          fi
           # Zero resource changes prove the prior run's apply completed and no
           # restart will follow, keeping the incarnation check honest. Root
           # outputs may lag a targeted apply, so judge resource_changes only.
@@ -502,6 +514,7 @@ jobs:
                 --rehome-director-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
                 --rehome-audience https://relay.onorca.dev/v1/admin/host-drain \
                 --regional-rehome-protocol "${DESIRED_REHOME_PROTOCOL}" \
+                "${POOL_ARGUMENTS[@]}" \
               | jq -e '.changes == 2' >/dev/null
           fi
           gcloud compute instance-groups managed wait-until "${MIG_NAME}" --stable \
@@ -514,6 +527,11 @@ jobs:
           CAPACITY_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_CAPACITY_SERVICE_ACCOUNT }}
           DIRECTOR_RUNTIME_SERVICE_ACCOUNT: ${{ vars.PRODUCTION_GCP_RELAY_DIRECTOR_RUNTIME_SERVICE_ACCOUNT }}
         run: |
+          # A cell on the root pool default emits no pool line, so pin one only where it exists.
+          POOL_ARGUMENTS=()
+          if test -n "${EXPECTED_DATABASE_POOL_MAX}"; then
+            POOL_ARGUMENTS=(--database-pool-max "${EXPECTED_DATABASE_POOL_MAX}")
+          fi
           terraform -chdir=infra/terraform plan \
             -var-file=environments/production.tfvars \
             -var-file="${RUNNER_TEMP}/relay-same-cap.tfvars.json" \
@@ -528,7 +546,8 @@ jobs:
               --rollback-image "${IMAGE_REPOSITORY}@${CURRENT_IMAGE_DIGEST}" \
               --rehome-director-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
               --rehome-audience https://relay.onorca.dev/v1/admin/host-drain \
-              --regional-rehome-protocol "${DESIRED_REHOME_PROTOCOL}"
+              --regional-rehome-protocol "${DESIRED_REHOME_PROTOCOL}" \
+              "${POOL_ARGUMENTS[@]}"
           terraform -chdir=infra/terraform apply -auto-approve \
             "${RUNNER_TEMP}/relay-same-cap.tfplan"
           gcloud compute instance-groups managed wait-until "${MIG_NAME}" --stable \