Remove the PostgreSQL savepoint resource-owner depth limit

[marcobambini]

Applying a payload read from a PostgreSQL table at 126 or more user savepoints could fail with buffer pin ... is not owned by resource owner SubTransaction. The fixed 128-entry owner/context array silently stopped recording Cloudsync's additional internal subtransactions.

Replace the array with a stack of frames allocated in TopTransactionContext, keyed by subtransaction ID. Commit and rollback restore the caller's resource owner and memory context from a local copy. Subtransaction callbacks remove completed or externally aborted frames, and transaction callbacks clear the stack. Snapshot replacement remains limited to the outermost Cloudsync savepoint. PostgreSQL's own resource limits still apply, but Cloudsync no longer imposes the fixed depth cap.

Validation

• Full suites on PostgreSQL 15.19, 17.11 and 18.6: 546 checks pass on each.
• New regression/stress test at depths 1, 125, 126, 127, 128, 256, 1024 and 2048, using a heap scan as payload input.
• Rollback, replay in the same transaction and commit at every depth.
• 100 caught trigger failures at depth 256, followed by successful apply in the same backend.
• Negative control: restoring the original implementation reproduces the resource-owner error at depth 126.

The test is included in full_test.sql; docs/internal/deep-savepoints.md explains the defect, lifetime handling and results.

This is one of three independent follow-ups to #64, based on pg-fixes11092026 at 9d0abb3. Retarget to main after #64 merges. These tests run against local PostgreSQL instances, not a deployed cloud server.

Cloud integration reliability

The shared chunked-tenant job is serialized across branches with a queued concurrency group. This prevents a different PR from writing during the negative-cache test's required idle phase; all idle assertions remain intact, and other platforms still run in parallel.

Fresh receivers now wait for actual received rows and expected fixture data rather than requiring the first poll to contain rows. Polling is bounded and SQL/protocol failures abort immediately. A materialized result ensures one network call per attempt. The offline integration_bootstrap test runs as part of make unittest, covering 312 scenarios including delayed/partial delivery, timeout, missing data, protocol errors and malformed responses. Local ordinary and ASan/UBSan runs pass with zero outstanding SQLite memory.

Latest CI verification

Workflow run 35443342025 completed successfully on 6ae57f4: 37 jobs passed, with only the release job skipped. The real-cloud negative-cache test ran and passed on Linux x86_64.