GS: ClickHouse 26.8+ commit-cursor append refresh

Parent: #398
Depends on: #400, #401, #402

Design:

• docs/design/google-sheets/append-refresh.md
• docs/design/google-sheets/decisions.md

Scope

Implement capability-gated append-only refresh for eligible direct MergeTree/ReplicatedMergeTree sources using per-partition persistent _block_number and _block_offset checkpoints and finite bounded SELECT queries.

Acceptance criteria

• Append UI requires configured minimum version (initially 26.8) and successful runtime capability probes.
• Eligible query validation permits one deterministic direct source and rejects joins, views, FINAL, aggregation, DISTINCT, window functions, UNION, table functions, and business LIMIT.
• Binding pins table UUID, query hash, schema hash, source-subset parameters, and initialization mode.
• Initial modes support history export and future-only checkpoints.
• Refresh captures finite per-partition upper boundaries.
• Pages are ordered and filtered by _block_number / _block_offset and use decimal-string UInt64 values.
• Each Google commit copies exact staged rows and advances only the corresponding partition checkpoint in the same publication batch.
• A closed tab resumes from the last committed page without duplicates.
• Invalid capability, UUID, query, schema, parameter, row-count, or checkpoint state requires explicit full refresh.
• SELECT ... STREAM, updates, deletes, and silent fallback are absent.

Concurrency

Use advisory lease metadata and generation rechecks. Strict distributed locking is out of scope.

Commencez par lire docs/design/google-sheets/append-refresh.md et docs/design/google-sheets/decisions.md, puis examinez les dépendances #400, #401 et #402. Utilisez les critères d’acceptation indiqués pour définir l’achèvement, notamment la validation capability-gated, les checkpoints de partition persistants, les pages de refresh bornées, les commits Google exacts, le comportement de reprise et la gestion explicite du full-refresh pour un état invalide.