release: fix reader privilege blockers and sample slot race

[NikolayS]

Closes #164.
Closes #166.
Closes #169.

What changed

• Preserve complete direct reader bundles, including the installer-default pg_monitor bundle, across ash.rebuild_partitions() by reusing the installer's _ash_install_reader_roles snapshot/replay mechanism.
• Refuse ash.revoke_reader() when its target owns schema ash, is current_user, or is a superuser. Keep _admin_funcs() out of reader grants and scrub its legacy EXECUTE grant during installer re-apply.
• Stamp each ash.sample row with the already captured v_current_slot, so packed query-map IDs and their slot cannot diverge during rotation.
• Correct README/RELEASE_NOTES guidance around partition rebuilds and reader ACL preservation.

Regression coverage

• Release blocker: rebuild_partitions strips all reader grants #164: exact direct ACL checks before/after rebuild_partitions(6, 'yes'); immediate empty-reader smoke test; delayed sample insertion; custom reader plus a plain pg_monitor member.
• Release blocker: revoke_reader can brick a non-superuser-owned installation #166: isolated database owned by a LOGIN/NOSUPERUSER role; exact refusal message and no privilege loss; independent owner/current-user/superuser branches; fresh reader and legacy _admin_funcs() ACL re-apply coverage.
• Bug: take_sample can stamp query-map IDs with the wrong slot during rotation #169: forced two-value ash.current_slot() transition proves the sample uses the captured slot and reads it once; exact query attribution and insert_errors = 0; normalized function-definition assertion proves there is exactly one ash.sample INSERT path and that it names slot explicitly.

Local validation

• PostgreSQL 17.9 fresh install, installer re-apply, and full upgrade chain
• Verbatim RED reproduction and GREEN regression runs for Release blocker: rebuild_partitions strips all reader grants #164, Release blocker: revoke_reader can brick a non-superuser-owned installation #166, and Bug: take_sample can stamp query-map IDs with the wrong slot during rotation #169
• Workflow YAML parse, targeted embedded-shell syntax, and git diff --check

The N2 behavioral probe deterministically forces the slot transition. Its tagged one-active-backend fixture is controlled in CI, but—as with any pg_stat_activity fixture—could be perturbed by an unexpected concurrent client in a shared local database; the structural assertion remains fully deterministic.

This draft was rebased onto current origin/main immediately before push. It still needs a fresh rebase onto origin/main before merge.

[NikolayS]

Pre-merge verification complete after rebasing onto main (8eff377). codex review --base origin/main stood in for REV because REV is unavailable; its first pass found two real least-privilege gaps, both now fixed, regression-covered, and clean on a second independent review.

Conflict resolution:

• In sql/ash-install.sql, retained the corrected fix: ignore excluded raw ring slot #129 catalog formula (num_partitions - 2) * rotation_period while preserving release: fix reader privilege blockers and sample slot race #181's automatic complete reader-bundle replay wording and behavior.

RED / GREEN:

• Release blocker: rebuild_partitions strips all reader grants #164 RED on current main: after rebuild_partitions, both a configured reader and a pg_monitor member failed on query_map_all; direct ACL count was zero. GREEN: schema/function/relation bundle is restored and both readers see the seeded key. Added a function-only-role regression so partial grants cannot be widened into a full bundle.
• Release blocker: revoke_reader can brick a non-superuser-owned installation #166 RED on current main: revoking protected owner/current roles succeeded or failed only after partial ACL mutation. GREEN: protected targets are rejected before mutation; legacy _admin_funcs() reader grants are scrubbed. Added delegated-GRANT-OPTION coverage and changed the legacy scrub to CASCADE so stale delegated access cannot survive.
• Bug: take_sample can stamp query-map IDs with the wrong slot during rotation #169 RED on current main: take_sample() resolved slot 0 but stamped slot 1 after a probe changed current_slot (two reads). GREEN: it captures once, resolves and stamps slot 0, and records one current_slot read.

The rebuilt ACL logic remains dynamic: it derives the non-admin helper closure rather than freezing a function list. This is important for the upcoming #189 helper; after #189 lands I will explicitly verify ash._raw_oldest_sample() receives reader EXECUTE through this bundle.

Targeted PostgreSQL verification passed for all three scenarios, YAML parses, git diff --check is clean, and the second Codex review returned no findings.

[NikolayS]

CI follow-up: the first rebased run exposed a stale v1.5 upgrade-test oracle, not a product regression. The upgrade correctly scrubbed the legacy reader grant on newly-admin _admin_funcs(), while the old equivalence sweep still required every historically reader-visible name to retain EXECUTE.

Fixed in 34671bb by filtering both upgrade/re-apply sweeps through the current dynamic ash._admin_funcs() exclusion and adding explicit assertions that _admin_funcs() is denied after both transitions. The full affected v1.5 → current → wrapper re-apply step now passes locally on PostgreSQL 17 with cron absent (matching the first failing matrix variant), including state preservation and reader-surface behavior.