release-26.2: sql/catkv: refresh stale name->ID mappings in SystemDatabaseCache

[dt]

Backport 3/3 commits from #169044.

/cc @cockroachdb/release

---

The per-node SystemDatabaseCache holds name→ID mappings for system database namespace entries for the lifetime of the process. Until now it treated the first observation of any name as authoritative: once a name was cached, subsequent observations of the same name with a different ID were silently dropped. The comment on the type even codified this as an assumption ("for a given name and a given cluster version, the name to ID mapping will never change for the life of process").

That assumption does not hold for PCR reader tenants. A reader tenant is bootstrapped with its own dynamically-allocated IDs for system tables that lack a fixed reserved-range ID (e.g. system.privileges), and then SetupOrAdvanceStandbyReaderCatalog rewrites the namespace to point those names at the externalized descriptors replicated from the source tenant, which carry the source's IDs.

Any cache entry populated between reader tenant startup and that rewrite — and the very first user authentication populates one for system.privileges via the synthetic privilege cache — pins the bootstrap-time ID forever. Since the rewrite also deletes the descriptor at the bootstrap-time ID, every subsequent name resolution that hits the cache returns an ID that no descriptor exists for, and lookups fail with resolved <name> to <id> but found no descriptor with id <id>. Restarting the reader tenant masks the bug because it discards the cache.

This change permits the cache to replace an existing entry when an incoming observation has the same name but a different ID and a strictly newer MVCC timestamp than the cached entry. The MVCC timestamp guard ensures a stale read at an older AOST cannot regress a fresher mapping, and the same check is repeated under the write lock in update so a concurrent fresher write cannot be clobbered by a slower stale one. The warm-up entries inserted at construction carry a zero MVCC timestamp, so any real KV-sourced observation dominates them, which is the desired behavior.

Resolves #153555.

Epic: none
Release note (bug fix): A physical cluster replication reader tenant no longer fails authentication and other queries with errors of the form resolved <name> to <id> but found no descriptor with id <id> after the reader tenant ingests a system table at an ID different from the one it was bootstrapped with. Previously, a per-node namespace cache could pin the bootstrap-time ID and require a tenant restart to recover.

Release justification: bug fix for PCR reader tenant authentication failures

[blathers-crl]

Thanks for opening a backport.

Before merging, please confirm that the change does not break backwards compatibility and otherwise complies with the backport policy. Include a brief release justification in the PR description explaining why the backport is appropriate. All backports must be reviewed by the TL for the owning area. While the stricter LTS policy does not yet apply, please exercise judgment and consider gating non-critical changes behind a disabled-by-default feature flag when appropriate.

[trunk-io]

😎 Merged successfully - details.

[cockroach-teamcity]

This change is 

[spilchen]

LGTM