[experimental] CAS (Content-addressed storage) over shared object storage for antalya-26.6

[filimonov]

What this is

A new opt-in metadata storage type cas for object-storage disks: MergeTree parts are stored
as content-addressed blobs in a shared S3/GCS bucket pool, deduplicated by content hash, with
part manifests and named refs on top — "git for MergeTree". Multiple servers mount the same
pool and share identical data blocks without re-uploading them; same-pool replication fetches
publish a local ref over the shared blobs instead of copying bytes (fetch-by-relink). Garbage
collection runs as a lease-coordinated background round with full audit trail; integrity is
checkable online with SYSTEM CAS FSCK and the clickhouse-disks cas-* applets.

User-facing surface: the cas disk/metadata-storage type, SYSTEM CAS GC RUN / GC REBUILD / FSCK / DROP POOL MEMBER, system tables system.cas_log, system.cas_gc_log,
system.cas_mounts, and the clickhouse-disks commands cas-inspect, cas-fsck,
cas-gc-dryrun, cas-gc-rebuild, cas-drop-member. Full documentation ships in this PR under
docs/en/antalya/cas/ (architecture and operations), plus the system-table pages.

How the series is structured

29 commits, ordered for review; the subsystem lands dark and is switched on by one registration
line.

1. Upstream fixes (11 commits) — standalone correctness fixes to shared code, each
   reviewable on its own: ReadBufferFromFileView position tracking, ReadBufferFromS3
   retry-after-cancel, ThreadGroup parent lifetime, MergeTreeDeduplicationLog fail-closed
   null-writer, S3 conditional writes + 412 no-retry policy, Expect: 100-continue for large
   conditional uploads, GCS conditional-write dialect and GOOG4 signer, LocalObjectStorage
   snapshot listing semantics, the disk-transaction contract (one logical part = one
   transaction, read-your-writes), SYSTEM-on-proxy unwrap, and clickhouse-disks non-zero exit
   code for failed non-interactive commands.
2. The CAS subsystem (8 commits) — a layered library under
   src/Disks/DiskObjectStorage/MetadataStorages/ContentAddressed/, bottom-up:
   Primitives → Formats → Backend → Pool → Parts → Gc → Tools. No layer is reachable until
   the wiring lands.
3. Integration (4 commits) — the metadata storage and disk transaction, capability
   predicates, the registration line, system logs and tables, SYSTEM commands, registries and
   entry points, fetch-by-relink in DataPartsExchange.
4. Tests (3 commits) — the gtest battery (134 files), stateless and integration suites.
5. CI wiring and docs (3 commits) — CAS-default test lanes, tags for tests that cannot run
   on CAS, and the documentation set.

Behavior changes to shared code (reviewers, look here)

Everything CAS-specific is gated behind the cas disk type; a server without a cas disk gets
identical behavior except for these deliberate fixes:

• clickhouse-disks --query now exits non-zero when a command fails (previously always 0);
  interactive sessions unaffected. This exposed and fixes two latent test defects
  (test_disks_app_func path typo, test_replicated_database reading metadata_path after
  DETACH).
• HTTP 412 on conditional S3 requests is never retried (deterministic failure; also benefits
  pre-existing Iceberg conditional writes).
• The disk-transaction contract commit routes projection sub-parts through the parent
  whole-part transaction and makes staged state readable before commit — behavior-preserving on
  local disks, stricter on object-storage metadata.
• ReadBufferFromFileView position fix also affects the pre-existing packed skip-index reader.

Verification

• Per-layer gtest battery (src/Disks/tests/, 134 files) plus stateless and integration
  suites; CI runs a CAS-default-disk lane over the general stateless set.
• Long-running soak/chaos harness (multi-node shared pool, fault injection, fsck-verified
  invariants) has been green on this tree; the harness itself is intentionally not part of this
  PR.
• The branch is a clean reconstruction of the development tree: the diff between this series
  and the development branch, restricted to shipped paths, is empty by construction.

Developed with AI assistance (Claude); every commit carries Co-Authored-By and
Signed-off-by.

Changelog category (leave one):

• Experimental Feature

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Added experimental content-addressed storage (CAS) for MergeTree: a new cas metadata storage
type for object-storage disks that stores parts as content-hash-deduplicated blobs in a shared
S3/GCS pool with manifests and refs, allowing multiple servers to share identical data without
re-uploading it, replicate same-pool parts without transferring bytes, and reclaim unreferenced
data with lease-coordinated garbage collection. Includes SYSTEM CAS GC RUN / GC REBUILD / FSCK / DROP POOL MEMBER, system tables system.cas_log, system.cas_gc_log,
system.cas_mounts, and clickhouse-disks commands cas-inspect, cas-fsck, cas-gc-dryrun,
cas-gc-rebuild, cas-drop-member.

Documentation entry for user-facing changes

Documentation is included in this pull request: docs/en/antalya/cas/ (architecture and
operations), docs/en/operations/storing-data.md, docs/en/sql-reference/statements/system.md,
and the three system-table pages.

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [056488b]