fix(cluster): close S3 preflight coherence gaps

[sqlrush]

What this changes

• require an exact unencumbered local PCM-X ownership state before ConditionalLockBuffer can return write authority
• run the existing held-content-lock barrier guard before holder retry sleeps, preventing a foreign frozen holder from deadlocking RETIRE
• retry DENIED_RESOURCE_RECOVERING inside the bounded PCM-X image-fetch budget instead of misclassifying it as corrupt image bytes
• update t/020-t/023 injection registry snapshots from the stale 181 count to the production 183 count

How it was tested

macOS, local cluster-enabled build:

• make -C src/backend/storage/buffer bufmgr.o
• make -C src/backend/cluster cluster_gcs_block.o
• CLANG_FORMAT=/opt/homebrew/opt/llvm@18/bin/clang-format scripts/ci/check-format.sh — 580 files, 0 violations
• make -C src/test/cluster_unit check — all 182 binaries passed
• make -C src/test/cluster_tap check PROVE_TESTS="t/020_shmem_registry.pl t/021_block_format.pl t/022_itl_slot.pl t/023_buffer_descriptor.pl" — 4 files / 83 tests passed

The F1, F2, and image-fetch source-contract tests were each observed RED before the production fix and GREEN afterward.

Checklist

• This PR does not change the non-cluster runtime path; the bufmgr.c behavior change remains under USE_PGRAC_CLUSTER.
• Runtime checks use production branches, not Assert()-only checks.
• Code matches the repository clang-format gate.
• Tests were updated for each changed contract.

[sqlrush]

Guardkeeper handoff (S3 preflight):

• Install and verify exact public-code main c0293c68769c1925ec3d0fb82678bf33957f70ad on the healthy four-node rig (real make install, then confirm all nodes run the new install).
• Harness fail-closed is already merged in RACvsRAC main c0627caa7e017af3a47d5ee8b7e147fcb3f4fd22; local confirmation: judge synthetic suite 18/18 and Java worker/warmup/teardown/zero-ops suite ALL PASS.
• Run t/400 on the newly installed main. If GREEN, proceed directly to the approved S3 1x32x3 and 4x32x3 legs; hard gates remain CSV errors=0, every node total_ops>0, no warmup/worker failure, and valid row structure.

Codex does not operate the VM; please report the install identity and t/400/S3 evidence here or through the existing guardkeeper channel.