perf(db): stream the index-operation backlog at writer open

[xav-db]

Fixes HEL-957.

Problem

At writer open, load_backlog fully decoded every queue of a scope (every payload, including 1536-dimension vectors) into one Vec before charging any of it to the admission ledger. So open's peak memory and time grew with the whole durable backlog: about 25 s and 4.5 GB for 2.26 GB of queued work. Each scope also cost about 4 scans (scope seek, record scan, layout probe, queue scan).

Fix

before: for scope: decode every queue of scope -> Vec -> charge all
after:  one forward scan per keyspace (legacy, then tenants)
          row -> QueueDiscovery::push -> completed queue? -> validate owner -> charge -> drop

• Streaming discovery. QueueStore::discover is replaced by QueueDiscovery, which takes rows in key order and returns each queue as soon as it is complete. In the map layout each row is a whole queue. In the row layout a generation completes when the next generation's first row arrives, or at finish(). Open now holds one queue at a time plus the ledger.
• Framing only. OperationFrame::decode_queue / decode_row read each operation's ID, entity and retained bytes. Payloads are validated in place (algebra::validate_body) and never decoded. The values and rows they reject are exactly the ones OperationQueue::decode / QueueRow::decode reject (duplicate IDs, NaN, UTF-8, trailing bytes, unresolved values). A proptest checks this, and OperationQueue::decode and OperationFrame::decode_queue share one record walk (decode_unique), so their duplicate-ID check cannot drift.
• Fewer scans.
  • One scan covers the legacy scope.
  • One forward-only iterator covers the tenant keyspace, with at most 2 seeks per tenant.
  • Index records are read only for scopes that have a queue, and are cached per scope.
• Layout check folded in. discovery_range spans both layouts' adjacent record kinds (a const assert checks this). A queue of the other layout still fails closed with Config, during the same scan. The separate probes (require_scope_layout, require_layout, discover_scopes) are now compiled only for tests and the benchmark feature.
• Ledger only. Open fills the admission ledger and nothing else: publication starts with no retained queue, schedule or held entity, and each target's first attempt reads and groups its own queue (StoredQueue).
• Removed: QueueStore::discover, finish_rows and OperationQueue::from_rows. OperationQueue::operations() is now compiled only for tests and index-lifecycle-testing.
• Unchanged:
  • Charge order (legacy first, then tenants ascending).
  • Owner validation.
  • The row-layout sequence resume.
  • The worker wake.
  • The feat(db): asynchronous vector and text index publication #1156/fix(db): hold back only the index entity whose publication keeps failing #1165 invariants: the indexer is the only writer of index rows, and held-entity state starts empty either way.

Behaviour changes

• A corrupt IndexRecord in a tenant that has no queue no longer fails writer open. That tenant's first catalog read fails instead (Encoding), and the other tenants keep working. A corrupt record in a scope that has a queue still fails the open.
• No config or API changes.

Measurements (EC2 c7i.8xlarge, release)

Fixture: 6 legacy vector queues of 256 MiB, 8 tenant queues of 64 MiB (dropped indexes), and 2000 tenants with rows but no queue. That is 14 queues, 366,930 ops and 2.26 GB retained, about 6 GB on disk. Each run starts from a fresh copy of the fixture, 4 runs each, and every run loaded the same totals.

Phase	base	this PR
Backlog load only (no compactor)	15.1–15.3 s, peak 2.17–2.22 GB	4.63–4.86 s, peak 1.14 GB (flat)
Full writer open (compactor running)	24.4–24.8 s, peak 4.33–4.65 GB	4.83–5.01 s, peak 1.22–1.30 GB

• Open is about 5× faster.
• The base column was measured on main. linear-queue-publication-drain does not touch the open-time load path (recovery.rs, queue discovery), so it applies unchanged.
• Without the compactor, this PR's peak scales with the largest queue: about 0.85 GB at 128 MiB queues, 1.14 GB at 256 MiB. The base's peak scales with the whole backlog.
• Open peaks above the load-only peak come from SlateDB's background compactor running during open, not from the load.

Testing (EC2)

• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings and cargo check --locked --workspace --all-features are clean.
• cargo test -p db --lib: 2,082 passed. cargo test -p db --doc: 40 passed.
• Release production targets (queue publication, index-operation queue, text queue, text correctness regressions, internal, contracts, migration, index lifecycle), one test thread each: 186 passed.
• cargo test -p server: 79 passed.
• scripts/validate-cargo-target-references.py passes.
• Product image, docker-image/test.sh and index_queue_contracts.py --scenario all pass. After SIGKILL and restart, 10,750 docs are exact on local disk and on S3. The member limit rejects at 250k and accepts again 1.4 s after the build activates.
• New recovery_tests compare every load against a reference loader that fully decodes each queue the old way. They cover:
  • legacy and tenants 0, 7, 8 and u128::MAX, with keys on both sides of each range;
  • the map layout across the compacted run, L0 and the memtable, with partial and full acks;
  • the row layout, with interleaved generations and the sequence resume;
  • the other layout failing closed in every scope;
  • corrupt payloads, duplicate IDs, foreign keys and invalid tenant envelopes failing closed;
  • misowned tenant queues after other scopes' records are cached (this test fails if the per-scope cache goes stale);
  • an SST read failure injected at every point during open, after which every reopen reloads the same ledger and writes nothing;
  • a full writer restart that reloads the ledger exactly, starts with no queue reads, retained bytes, schedules or blocked entities, and drains each reloaded target in exactly 2 reads.
• Production contracts add a tenant scope-walk test and duplicate-ID / corrupt-payload cases.
• open_measurement_tests is an ignored, manual release benchmark that produced the numbers above.

No stored format changes.

Expected CI follow-up: the DB coverage fingerprint will change. Rows-layout-only lines are uncovered in production targets, and line numbers shift. Take the new count and sha from this PR's ARM64 "DB production thresholds" job, after linear-queue-publication-drain merges and this PR is retargeted to main.

[greptile-apps]

Malformed tenant keys go undetected When a stored tenant key is an incomplete envelope that sorts before tenant zero’s queue prefix, such as the single byte 0xFD, this scan starts after it. The previous scope discovery rejected that key as catalog corruption; writer open now succeeds without detecting it, weakening the fail-closed corruption check. Start the tenant walk at the tenant-keyspace prefix and seek into queue ranges after validating the first key.