Carry an operator's postgresql.conf lines below the include across a major upgrade (#4358)

[erikdarlingdata]

Refs #4358.

Why

DarlingStoreUpgrade.CarryAutoConfAsync carries only postgresql.auto.conf across a major PostgreSQL
upgrade. Lines an operator adds below the darling-managed.conf include in postgresql.conf were not
copied into the new cluster; they stayed behind in the old (retained) data directory. #4336's docs point
operators at ALTER SYSTEM as the only carried path today; #4358 closes that gap for postgresql.conf
itself.

What changes

• ManagedConfMigration.ExtractOperatorLinesBelowInclude(string postgresqlConf) (pure, no disk I/O):
  given a postgresql.conf's text, returns every raw line strictly after the darling-managed.conf
  include, in original order, using the same PostgreSQL-accurate include detection
  Rewrite/HasManagedInclude already use (never a raw string match). A legacy conf (no working include)
  returns nothing — this change is scoped to the migrated shape.
• DarlingStoreUpgrade.CarryOperatorConfLinesAsync: wired into UpgradeDataDirectoryAsync
  immediately after CarryAutoConfAsync (post-swap, one pattern). Reads the OLD (retained) cluster's
  postgresql.conf, extracts the below-include region, and probes each ASSIGNMENT line one at a time
  against the new binaries with postgres -C — the same per-setting isolation CarryAutoConfAsync
  gives auto.conf settings. A comment, blank line, or operator
  include/include_if_exists/include_dir directive is carried unconditionally (there is no GUC name
  to hand -C). A rejected line is logged (name only; the same secret-name-fragment withholding
  CarryAutoConfAsync already applies) and skipped — never fatal to the upgrade. Carried lines are
  appended to the new cluster's postgresql.conf AFTER the legacy blocks context.AppendManagedConf
  already wrote (step "conf-new-cluster"), under ManagedConfMigration.MovedOperatorLinesComment
  (reused — provenance need not distinguish a same-major move from a cross-major carry). Never throws: an
  unexpected exception resets postgresql.conf to its pre-carry (legacy-appended) baseline and logs a
  warning naming the retained old data directory as the manual fallback, matching CarryAutoConfAsync's
  own "never brick a completed upgrade" posture.

Test plan

• GREEN, in-process on macOS — ManagedConfExtractOperatorLinesTests.cs (5 unit [Fact]s, no live PG):
  Total: 5, Failed: 0.
• GREEN, in-process on macOS — DarlingStoreUpgradeTests.CarryOperatorConfLinesAsync_CarriesAfterTheLegacyBlocks_OperatorValueWins
  (ordering pin): after the carry, the new cluster's postgresql.conf holds the carried operator block
  AFTER the legacy block, parsed with ParseConfText, and the operator's log_min_duration_statement
  value wins over the legacy block's own copy of the same key.
• GREEN, in-process on macOS — DarlingStoreUpgradeTests.CarryOperatorConfLinesAsync_RejectedLine_IsSkippedAndLogged_OthersStillCarried_NeverFatal
  (rejected-line-never-fatal pin, via the substitutable probe delegate — no real postgres.exe): one
  candidate line the probe rejects is skipped and logged (NOT carried: darling_4358_unknown_setting),
  the other two candidates are still carried, and the method returns normally.
  Both new pins run as dotnet Darling.Tests.dll -class Darling.Tests.DarlingStoreUpgradeTests -method "*CarryOperatorConfLinesAsync*" → Total: 2, Errors: 0, Failed: 0.
• RED confirmed at d20aa68e4 (before the CarryOperatorConfLinesAsync wiring commit): copying the new
  test file into a detached worktree at that commit and building fails to COMPILE —
  CS1061: 'DarlingStoreUpgrade' does not contain a definition for 'CarryOperatorConfLinesAsync' — the
  member does not exist yet, so both new unit pins are RED by compile failure, as expected.
• UNCHECKED, _Gated — extends ManagedConfUpgradePathTests.cs —
  UpgradeInPlace_OperatorLineBelowInclude_CarriedAndApplied_NoManagedKeyDuplicated_Gated: runs a real
  end-to-end major upgrade (DarlingManagedPostgres.EnsureRunningAsync) with an operator line
  (log_min_duration_statement = 4358) appended below the include in the OLD cluster's migrated
  postgresql.conf. Asserts the line is present in the NEW cluster's postgresql.conf after the upgrade,
  APPLIED per pg_file_settings (not pg_settings.sourcefile, which still names postgresql.conf for an
  unchanged value), and that shared_preload_libraries = 'timescaledb' appears exactly once (no managed key
  duplicated between the legacy block and the carried operator block). Builds clean (0 Warning(s), 0
  Error(s), both Darling.Tests.csproj and Lite.Tests.csproj), and is correctly SKIPPED on this macOS run
  (1 Skipped in the ManagedConfUpgradePathTests class run) because it needs DARLING_TEST_PGRUNTIME_OLD /
  DARLING_TEST_PGRUNTIME_NEWZIP and the managed runtime is Windows-only. On the pre-Carry operator lines below the darling-managed.conf include across a major PostgreSQL upgrade #4358 code the
  operator line assertion fails outright: DarlingStoreUpgrade has no CarryOperatorConfLinesAsync and
  UpgradeDataDirectoryAsync never calls it, so the operator's below-include line never reaches the new
  cluster at all — both the presence assertion and the pg_file_settings.applied assertion fail. CI decides
  this pin on Windows with the PG runtime fixtures set.
• Also ran (unaffected, still GREEN): ManagedConfMigrationStateTests (Total: 6, Failed: 0),
  ManagedConfRewriteOperatorSafetyTests (Total: 5, Failed: 0), ManagedConfUpgradePathTests
  (Total: 5, Failed: 0, Skipped: 1 — the new _Gated pin).
• Build: Darling.Tests.csproj -p:EnableWindowsTargeting=true and Lite.Tests.csproj -p:EnableWindowsTargeting=true — 0 Warning(s), 0 Error(s) on macOS, after every change in this session.

CHANGELOG entry

SECTION: Fixed
ENTRY:

• Carry an operator's own postgresql.conf lines below the darling-managed.conf include across a major PostgreSQL upgrade ([Carry an operator's postgresql.conf lines below the include across a major upgrade (#4358) #4405]) - previously only postgresql.auto.conf (ALTER SYSTEM) settings survived a major upgrade; a hand-edited line below the include stayed behind in the retained old data directory. Each carried line is now probed against the new binaries and skipped (never fatal) if rejected.
  REF:
  [Carry an operator's postgresql.conf lines below the include across a major upgrade (#4358) #4405]: Carry an operator's postgresql.conf lines below the include across a major upgrade (#4358) #4405