Admit retained relation ownership transitions for COW and arena promotion

[justinjoy]

Context

PR #1433 admits heap-owned, session-retained EDB relation columns and timestamps. Retained relations can still reach ownership-transition paths that are intentionally outside that unit: copy-on-write unsharing and arena-to-heap promotion.

Scope

Make retained relation ownership transitions participate in the shared memory governor without double-counting borrowed or arena-owned buffers.

• Admit COW unsharing before allocating newly owned heap columns.
• Admit arena-to-heap promotion before copying into heap storage.
• Cover col_rel_cow_unshare(), retained col_rel_append_row() ownership-transition branches, and col_rel_append_all() when an attached destination is supported.
• Publish the replacement reservation only after all allocations/copies succeed.
• Preserve readable rows, ownership flags, capacity, timestamps, and the prior reservation on denial.
• Release shared/arena and replacement ownership exactly once on destroy.

Tests

• Exact-fit and one-byte-over-budget COW growth tests.
• Exact-fit and one-byte-over-budget arena promotion tests.
• Denial preserves rows, capacity, ownership flags, timestamps, and reservation.
• ASan/UBSan coverage for success, denial, and destruction.

Dependency

Depends on #1430 and the heap-retained admission work in PR #1433.

[justinjoy]

Implementation PR

The approved COW and arena-ownership transition unit is implemented in PR #1444, based on the current head of PR #1433.

• Retained COW unshare and arena-to-heap promotion reserve before copying and publish transactionally.
• Unmanaged arena growth preserves arena ownership and timestamp ledger accounting.
• Denial/partial failure preserves rows, capacity, flags, pointers, and reservations.
• Normal, ASan/UBSan focused tests and the normal 9-test unit subset pass.

PR #1433 must be merged first; no merge was performed by this update.

[justinjoy]

PR #1444 has been repaired and force-updated safely (without merging).

• The stacked Admit retained EDB relation and timestamp capacity under the session budget #1430 duplicate history and unrelated Admit program-owned intern table growth under a retained governor lifetime #1431/Admit CSV intern and retained fact storage under the session budget #1428 intern/CSV commits were removed.
• The PR now contains only the retained relation COW/arena-promotion admission unit on current main.
• Added a regression test for exact-once memory-ledger reconciliation.
• Fixed duplicate ledger charging after COW in radix-sort and compaction paths.
• Normal focused tests: 5/5 passed.
• ASan/UBSan focused tests: 5/5 passed.
• Architect, Critic, and Reviewer: APPROVE.
• Current PR state: OPEN and MERGEABLE; no merge was performed.

[justinjoy]

Resolved by PR #1444 (merged 2026-09-09) with the follow-up in #1442. COW unsharing and arena-to-heap promotion of retained relations go through the shared governor (col_rel_cow_unshare, col_rel_grow_owned_transition, col_rel_promote_arena_admitted): the replacement reservation is published only after all allocations and copies succeed, denial preserves rows, ownership flags, capacity, timestamps and the prior reservation, and ownership is released exactly once on destroy. tests/test_memory_admission_relation.c covers exact-fit and one-byte-over COW growth, arena promotion, timestamp COW growth, denial state preservation and the COW ledger reconcile-once contract; it passes under ASan/UBSan on main (verified while landing #1442).