CAS improvements

[filimonov]

Closes: #2219
Closes: #2291
Related: #2233
Related: #2159

What this is

Follow-up to #2159 (the initial cas metadata-storage subsystem): correctness fixes, a
performance/reliability overhaul of the backend request layer, a wire-format key rename, and
three merged features (GC fold read-ahead, forced relink on fetch, GC teardown no longer
blocking on a round), plus a first phase of write-lane serialization for hot control objects
and a GC-cost cut for write-once keys. 22 commits, ~300 files, +38.6k/-19.4k restricted to CAS
paths. This is a curated, squashed reconstruction of the cas-gc-rebuild development tree:
internal design docs, plans and the soak-harness (utils/ca-soak) are intentionally not part
of this PR (dev-only tooling, no shipped behavior).

How the series is structured

1. GC round transient-failure classification + streaming publish — an S3_ERROR/
   NETWORK_ERROR/timeout during a GC round now yields Aborted (keeping leadership) instead
   of an indistinguishable Failed that zeroed real counters and dropped i_am_leader; the
   emulated blob-publication path streams instead of materializing ~1 GiB in memory. (Related CAS: replica HTTP dies on green-path soak after relink NETWORK_ERROR storm #2233)
2. NO_REPLICA_HAS_PART instead of NETWORK_ERROR for a relink-confirm refusal — a
   designed fail-closed outcome, not a network fault; fixes false Error-level triage and
   part_log hygiene checks. (Closes CAS: relink proof refusals are logged at Error with a stack trace despite being an expected outcome #2219)
3. Wire-keys phase 1 — carrier infrastructure (WireKey, EnumWireTable with
   set-equality coverage proofs) for every CAS wire-format codec; no bytes change yet.
4. Wire-keys phase 2 — the actual cut: every CAS JSON wire format moves from
   abbreviated/single-letter keys to descriptive names (kind, outcome, state, ...).
5. Wire-keys phase 3 — review polish and the extended ref-protocol benchmark.
6. Decode speedup — JSON object/row reader reuse across a stream's rows (57-81% faster
   decode), plus fixes that let the full stateless suite run locally.
7. cas: recommend single-replica merges (doc).
8. ALTER TABLE ... EXPORT PARTITION now works from a source on a CAS disk — it reads
   through a sequential source and writes via a sink, nothing is hardlinked on the source
   disk, so the CAS refusal was by omission, not by substance. (Closes CAS: EXPORT PARTITION from a CAS source is rejected with SUPPORT_IS_DISABLED #2291)
9. GCS mount: don't refuse on an unanswerable versioning probe — a missing
   storage.buckets.get IAM grant turned into a hard outage; now warns and continues. Plus
   three live-GCS test-suite corrections found on the first credentialed run.
10. Relink-confirm liveness scoped to the asked-about ref — the previous rule refused on
    any mutation of the same namespace, which live-GCS testing showed livelocking two
    replicas for 40 minutes under sustained write load; now scoped to the ref actually asked
    about.
11. Manifest decode cache keyed by id alone — no HEAD on a cache hit (a manifest id
    names its content, ever); retires the part_folder_validate setting that existed only to
    pace that HEAD.
12. CasRequests/CasOperation request engine (core) — replaces the free-form Token
    (which let an empty value pass as a fenced condition, silently turning a conditional write
    into an unconditional overwrite, among 8 other defect classes found across two design
    reviews) with a type only the backend can mint, a deadline-bound retry engine, and a
    SingleAttempt request mode that halves the request cost of a control-object read.
13. Migrate every CAS subsystem onto the engine — pool, GC, write, ref, mount, plus the
    matching test-double migration.
14. Incarnation→Etag/TokenType→Dialect rename, gtest suite onto the engine, delete
    the old controller — naming the type by its actual role instead of its wire field;
    ~120 mechanical test-file migrations; retires the ~1500-line legacy controller.
15. Post-engine review follow-ups and test hardening.
16. GC fold read-ahead (cas_gc_read_concurrency) — overlaps the fold's small-object
    round trips on a bounded pool without moving any decision off the round thread; measured
    1.65x on the round overall (2.4x on fold_ref_intake, which a live-GCS soak measured
    taking 97+ minutes unfinished).
17. A same-pool fetch always relinks onto the pool's disk — the receiver now advertises
    every pool of its storage policy instead of one guess, so a shared-pool fetch never moves
    bytes just because a TTL rule or volume order disagreed with the guess.
18. A disk's teardown no longer waits out a GC round — an in-flight round is refused at
    its next request/retry-sleep/refill via a teardown liveness carried on the open request
    plane, recorded as Stopped rather than Aborted.
19. GC round cost on write-once keys — a mount-floor read memoized per namespace per page
    instead of once per listed manifest, late/read-ahead manifest reads, and a bulk-delete verb
    for owner-removed manifests and ref-object cleanup. Measured on real GCS:
    fold_reduce 300-380s → 2-5s, manifest_deletes 617s → 2s, ref_object_cleanup 204s → <1s.
20. Hot-key write lane, phase A — one FIFO ticket per pool+key above the request engine
    for cas/ref_catalog's conditional writes, replacing same-process write races (measured:
    DROP TABLE p90 11.9s/max 34.7s, 113 PreconditionFailed in 80s from 53 threads) with
    queuing and combined commits.
21. ASan use-after-scope fixes in test fixtures whose captured locals outlived a store's
    teardown hook, plus a stateless-lane GC-scheduler interval tuning.
22. Single-attempt S3 client logs its failed attempt below Error — a SingleAttempt
    conditional-write attempt is resolved by an outer retry loop, not terminal; logging it at
    Error was a false-positive operator signal.

Verification

• CAS* gtest gate green throughout (the request-engine migration alone: 2406/2406 at its
  final checkpoint).
• test_cas_replicated_relink, test_cas_gcs, test_cas_gc_sharded, test_cas_gc_bulk_delete
  integration suites.
• Forced-relink and write-once-keys measurements taken on a real GCS soak stand (see commit
  bodies for exact figures); the hot-key write lane's contention measurements are from ten
  parallel stateless CI jobs.
• The branch's CAS-restricted diff against the exact cas-gc-rebuild commit each squash group
  was cut from is empty by construction (verified file-by-file before opening/updating this PR).

Developed with AI assistance (Claude); every commit carries Co-Authored-By and
Signed-off-by.

Changelog category (leave one):

• Experimental Feature

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Improvements and fixes to the experimental content-addressed storage (cas) metadata-storage
type: ALTER TABLE ... EXPORT PARTITION now works from a CAS-disk source; fetch-by-relink
always lands a same-pool part on that pool's disk instead of occasionally streaming its bytes;
a disk's teardown no longer blocks on an in-flight GC round; several GC-round cost cuts on
real object storage (round-trip counts down by 60-300x on the measured phases); a reliability
overhaul of the CAS-to-object-storage request layer closing several conditional-write edge
cases; and the CAS wire-format's internal JSON keys are renamed from abbreviations to
descriptive names (format generation reset; no compatibility concern, since CAS has no
released, persisted data yet).

Documentation entry for user-facing changes

Updated in this PR: docs/en/antalya/cas/architecture/{backend,garbage-collection,manifests-and-refs,mounts-and-leases,read-path,replication,storage-layout}.md, docs/en/antalya/cas/{index,configuration,bucket-requirements}.md, docs/en/antalya/cas/operations/{debugging,monitoring,troubleshooting}.md, docs/en/operations/storing-data.md, docs/en/operations/system-tables/{cas_log,cas_gc_log}.md.

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [67d337f]