build: bake the DuckDB extensions into the image

[jrosskopf]

A cold escurel pod downloaded ~137 MB of DuckDB extensions before it could serve anything, and against a Google Drive lake it never finished inside the substrate's 8m deploy timeout.

Measured in the cluster:

	duration
cold container	7m56s, still going
next start, same pod, warm cache	7 seconds to reach the catalog

Why a volume was not the fix

helm upgrade --atomic deletes the PVC when it rolls the release back, so the cache is destroyed by the very failure it exists to prevent. It could only ever help after a deploy had already succeeded — which was the thing that could not happen. That was tried; this replaces it.

What this does

ducklake, postgres, httpfs, fts, vss and gdrive are installed in a separate build stage and copied into the runtime image. 158 MB, and a pod downloads nothing at boot — which also removes a boot-time dependency on two extension repositories being reachable.

Verified against the constraints the chart imposes, not in a friendly shell

docker run --read-only --network none --user 65532:65532 …
  INSTALL ducklake; LOAD ducklake; INSTALL postgres; LOAD postgres;
  INSTALL fts; LOAD fts; INSTALL vss; LOAD vss;
  LOAD '…/gdrive.duckdb_extension';
→ no network, read-only, all loaded

--network none proves the baked cache is what was used. --read-only proves INSTALL no-ops against a pre-installed extension rather than needing to write — which was the one real risk in this design.

The build also asserts all six land under $HOME/.duckdb/extensions/<version>/<platform>. DuckDB resolves by that exact path, so a version or platform mismatch would silently download again at runtime — the failure that looks like success.

Two details that each cost a build, now encoded

• INSTALL postgres is an alias; the artifact it lands is postgres_scanner.duckdb_extension. Asserting the alias name failed the build while all six were present.
• HOME decides where DuckDB looks. The runtime image sets HOME=/opt/escurel to match the copy; a deployment that overrides HOME elsewhere silently reverts to downloading. (The heron-escurel values do exactly that today and will be updated alongside this.)

gdrive source

From the erpl.io mirror, not community: workload identity federation only exists in v2026.09.01, and the community repository still serves v2026.08.07, whose credential_chain refuses external_account outright. GDRIVE_REPO is a build arg — switch it once duckdb/community-extensions#2588 is merged and built.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}