Reconcile upstream v0.20.0 on the batched-observer fork

[seifghazi]

Why

Upstream v0.20.0 (eef30e8) adds wire.Query parse metadata, protocol version negotiation, TxStatus/Sync hooks, a 34000 error for unknown portals, and batched materialized rows with bounded encode scratch (upstream jeroenrinzema#151, which supersedes Shopify #16). This PR merges the tag as a real second parent on top of the batched-observer port (#18), keeping every Shopify contract from #15. #16 is intentionally not included.

What runs (Shopify delta on top of v0.20)

Execute(portal, MaxRows=N)
 └─ Portal.execute                                              cache.go
     clientLimit := N
     PortalSuspension(false)?  dw.limit = N; internal limit = NoLimit   (handler never parks)
     dw.batchable = clientLimit == NoLimit          ◀ client MaxRows, not the rewritten limit
     handler ─▶ WriteRows(w, rows)
                 └─ dw.Rows                                     writer.go
                     !batchable || dw.limit != NoLimit ─▶ dw.Row per row   (54000 at N+1)
                     else StartBatch(32 KiB) ─▶ columns.write(tm, scratch, observer=nil, encodeStats)
     encode stats flushed at PortalSuspended / Complete / error / teardown   (unchanged from #18)

Sync ─▶ handleSync ─▶ SyncConn? ─▶ readyForQuery: TxStatus idle ⇒ Portals.Close()

Behavior and risks

• Breaking API: ParseFn takes wire.Query{Query, ParameterOIDs, SimpleQuery}.
• MaxRows with PortalSuspension(false): a finite Execute is never batchable, and Rows also falls back to Row whenever a legacy limit is set. A naive merge (batchable: limit == NoLimit after the internal rewrite) would let WriteRows stream past MaxRows; rows_compatibility_test.go fails on that variant.
• Portal lifetime: an idle ReadyForQuery now closes every portal, so a suspended portal can only be resumed after Flush or inside a TxStatus transaction block. QE uses PortalSuspension(false), so this does not affect it.
• Execute on a missing portal returns 34000 on the synchronous path. The parallel pipeline path still returns upstream's plain unknown portal error.
• Protocol negotiation: unsupported minor versions or _pq_. options get NegotiateProtocolVersion; a different major version is rejected.
• GSS encryption negotiation is bounded to one request and reuses the existing reader. Repeated GSSENC is rejected before authentication instead of recursively growing the connection goroutine stack; pipelined GSSENC→Startup and GSSENC→SSLRequest→Startup remain valid.
• Only unlimited Execute + WriteRows batches (≤32 KiB chunks); Row still writes one frame per row.
• Kept: EncodeObserver/DataWriter.Formats, resumed parallel-portal writer rebind, per-caller Shutdown deadlines, cache error recovery (WriteError now takes ctx), close behavior.

Where to look

1. git show 446f849 --remerge-diff — the hand resolutions: cache.go (clientLimit → batchable), writer.go (legacy limit, Rows guard, observer stats plus scratch), row.go (tm/scratch plus observer arguments), options.go (both option sets).
2. git diff v0.20.0 HEAD -- . ':!*_test.go' — the whole Shopify delta on v0.20 (~200 lines).
3. rows_compatibility_test.go — MaxRows/batching and observer-through-Rows regressions.
4. pipeline_compatibility_test.go — resumed-portal regression, now resuming after Flush or a transaction-block Sync; it still fails without the parallel rebind.
5. handshake.go / handshake_gss_test.go — bounded GSSENC negotiation, pipelined startup preservation, and repeated-request rejection.

Later merges from #18 apply cleanly. 885ed04 brings in the publication-order fix. b35afd8 brings in #18's cherry-pick of upstream eef30e8 (golangci-lint 2.13.2); this branch already has eef30e8 through the v0.20.0 merge, so the tree is identical to 885ed04 and the CI files do not appear in this PR's diff.

Validation

• go test -race ./... passes with default pgx 5.4.3, with QE's pgx 5.7.6 (alternate modfile), and with Go 1.26. Focused -count=10 -race passes. golangci-lint 2.13.2 (upstream's pinned version) reports 0 issues. The merge commit alone builds and passes.
• Negative controls: a naive batchable without the Rows guard fails the WriteRows 54000/exact-limit tests on both sync and parallel paths; the naive batchable alone fails the not-batched test; the guard alone is covered by TestRowsKeepsLegacyLimitWhenBatchable; removing the rebind fails both parallel suspension cases.
• GitHub Actions test and lint pass on b35afd8. On 2637206, the GSS tests pass under -race -count=10; the vulnerable recursive implementation fails the pipelined and repeated-GSS regressions. Full go test -race ./... and golangci-lint 2.13.2 pass. No go.mod changes. No merge or tag.

Stack: #15 → #18 → this. QE requires v0.20.0 and will pin this head as v0.15.3-shopify.0.20260929200001-2637206111f2 (2637206) in shop/world #2109171.