fix(cluster): close S3 preflight runtime gate

[sqlrush]

Summary

• preserve native ConditionalLockBuffer behavior when PCM is inactive or a buffer is untracked
• keep retained images and ownership transitions fail-closed, and require exact X for active tracked buffers
• expose retryable PCM-X image-fetch recovery denials as an independent dump counter

Verification

• scripts/ci/check-format.sh: 580 files, 0 violations
• make -C src/test/cluster_unit check: 182/182 binaries
• cluster TAP t/020, t/021, t/022, t/023, t/251: 97/97 tests

This is the final code-side preflight hotfix before nightly, t/400, and the S3 two-leg run.

[sqlrush]

守门复审交接：

• 5a959f7c1b: ConditionalLockBuffer gate 现在仅在 cluster_pcm_is_active() && cluster_bufmgr_should_pcm_track(buf) 时要求 exact X；runtime-off/untracked 保留原生语义，retained/transition 仍 fail-closed。新增 helper 行为测试覆盖六腿，不再只靠源码 strstr。
• 06d24467e7: DENIED_RESOURCE_RECOVERING 使用独立 pcm_x_image_fetch_recovering_retry_count，已接 getter/dump，并滚 gcs_recovery 基线 10→11。
• 本地提交态：format 580/580、cluster_unit 182/182、TAP 97/97。
• fast-gate：Validate、Linux disable、Linux enable、Security、macOS 全绿。

请按上一轮 F1/P3 finding 做最终复核；通过后将直接 merge，随后跑 main nightly。