feat!: remove the bundled SSH tunnel in favour of the erpl_tunnel extension

[jrosskopf]

erpl bundled an SSH tunnel in tunnel/. It is superseded by erpl-tunnel, which does strictly more. Full analysis in TUNNEL_REMOVAL_PLAN.md.

Nothing is lost

	bundled tunnel/	erpl-tunnel
tunnel_create, tunnel_close, tunnel_close_all, tunnels()	yes	yes
ssh_tunnel secret	7 params	same type name + alias, all 7, plus mesh params
Reverse tunnels, tunnel_peers, tunnel_self, mesh backends, bind_all	—	yes
Published platforms	only inside the erpl bundle	get.erpl.io since 2026-07-26, including linux_arm64

erpl_rfc never depended on the tunnel in either direction — it is a plain port forwarder.

This is a bug fix, not just cleanup

While erpl bundled its own tunnel it silently shadowed the dedicated extension. Demonstrated against real artifacts:

LOAD erpl;
INSTALL '<erpl-tunnel>'; LOAD erpl_tunnel;   -- succeeds. No error, no warning.
SELECT function_name FROM duckdb_functions() WHERE function_name LIKE 'tunnel%';
-- tunnel_close, tunnel_create        ← only the old ones

The name was already claimed, so the second LOAD was a no-op. Nobody with erpl installed could migrate. Freeing the name is why the stubs live in erpl_rfc rather than in a surviving erpl_tunnel.

What remains

A stub per moved function, raising a message that names the extension, the two-line install, and the repo. Each carries the original named parameters so a realistic call reaches the message rather than a signature error.

The ssh_tunnel secret type is deliberately not registered — RegisterSecretType throws on a duplicate, which would make LOAD erpl_tunnel fail outright.

Stubs register only when the name is absent, so LOAD erpl_tunnel then LOAD erpl cannot displace a working implementation.

⚠️ Merge DataZooDE/erpl-tunnel#5 and release it first

Testing found the stubs would otherwise break the migration they advertise:

LOAD erpl_tunnel → Invalid Input Error: "Pragma Function with name "tunnel_create" already exists!"

RegisterFunction(PragmaFunction) and the CreateTableFunctionInfo overload leave on_conflict at ERROR_ON_CONFLICT. Fixing only the pragmas moved the abort to the tunnels table function and left the extension half-registered (loaded = false, tunnel_peers/tunnel_self missing) — which looks like success unless you count the functions. erpl-tunnel#5 makes those registrations replace instead.

Both load orders are now verified end-to-end: all nine functions present, real implementation serving, PRAGMA tunnel_close_all returns "All tunnels closed successfully".

Also

• libssh2 dropped from rfc/vcpkg.json; nothing else used it.
• sql_tests_tunnel and its docker-compose SSH mock removed.
• Trampoline no longer embeds/extracts/loads erpl_tunnel on any platform.
• Released bundle: 290 MB → 242 MB.

Testing

rfc 28/28 and odp 24/24 on both RFC backends; smoke test green; BICS running.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}