Harden cloud lease lifecycle and races

[smiggleworth]

Closes #94
Closes #95
Closes #136
Closes #137
Closes #138
Closes #139
Closes #140
Closes #141

Summary

• confirm ambiguous renewal writes after provider timeout or I/O failures before self-fencing
• defer mutation-gate disposal until every running or waiting lease operation drains
• make successful release end local authority without reporting an unexpected lease-loss callback
• reject invalid UTF-8 lease documents instead of accepting replacement characters
• cover conditional acquisition races, release and owner-token fencing, exact expiry boundaries, and malformed records

Compatibility

• no public API or persisted-format changes
• valid leader-style lease documents remain byte-compatible
• invalid UTF-8 now fails closed as corruption
• voluntary release preserves the persisted epoch handoff and makes the releasing coordinator unhealthy

Validation

• dotnet format Pants.slnx --verify-no-changes --no-restore
• dotnet build Pants.slnx --configuration Release --no-restore
• focused lease tests (27 passed)
• dotnet test Pants.slnx --configuration Release --no-build --filter Category!=Sqrzl (1180 passed)

[Copilot]

Pull request overview

This PR hardens the cloud primary lease implementation by addressing ambiguous renewal outcomes, disposal/operation races around the mutation gate, voluntary-release semantics, and stricter lease-document parsing, backed by expanded adversarial test coverage.

Changes:

• Route renewal outcomes that are ambiguous due to provider timeouts/I/O failures through the existing readback confirmation path (instead of immediately self-fencing).
• Defer mutation-gate disposal until all in-flight / waiting lease operations drain; adjust ReleaseAsync to end local authority without triggering the unexpected lease-loss callback.
• Fail closed on invalid UTF-8 lease documents and add tests covering acquisition races, release fencing, exact expiry boundaries, and malformed records.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/Pants.Tests/Support/TestDoubles/TestCloudObjectStore.cs	Adds seeding support to inject raw bytes/versions for lease-document parsing tests.
test/Pants.Tests/Support/TestDoubles/TestCloudLeaseStore.cs	Adds hooks and behaviors to simulate create/replace races and ambiguous write outcomes.
test/Pants.Tests/Cloud/CloudLeaseCoordinatorTests.cs	Adds targeted regression/adversarial tests for renewal ambiguity, disposal draining, CAS races, release fencing, parsing corruption, and boundary conditions.
src/Pants/Cloud/Internal/Leases/CloudObjectLeaseStore.cs	Enforces strict UTF-8 decoding and treats invalid bytes as corruption.
src/Pants/Cloud/Internal/Leases/CloudLeaseCoordinator.cs	Tracks active operations to safely dispose the mutation gate; broadens ambiguous renewal handling; adjusts release to end authority without spurious callbacks.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.