Make local server metadata atomic and concurrency-safe

[sdairs]

Summary

• write local server metadata through unique sibling temporary files with full writes, flush/sync, and atomic rename
• serialize ClickHouse and Postgres lifecycle, recovery, removal, and stale-PID normalization with per-server cross-process locks so stale state cannot overwrite a restart
• preserve selected metadata read, permission, parse, and write failures as distinct actionable human and structured errors
• add deterministic corruption, invalid UTF-8, permission, interrupted-write, concurrent lifecycle/client/stop, and stale-normalization/restart coverage

Closes #472

Tests

• cargo fmt --all --check
• cargo build -p clickhousectl
• cargo check -p clickhousectl --no-default-features
• cargo test -p clickhousectl
• cargo clippy -p clickhousectl --all-targets -- -D warnings

Stack

• Position: child 8 of 8 in gh-stack #489
• Base: Make omitted local server selection deliberate #514 (issue-473-omitted-server-selection)
• Parent PR is unchanged and should merge first.

[iskakaushik]

LGTM

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f64f3. Configure here.}

[cursor]

Start kills server after metadata commit

High Severity

write_server_info can return ServerMetadataWrite after a successful rename when directory sync fails, while leaving the new metadata document in place. ClickHouse start treats any save_info error as an uncommitted write and kills the child, so a durability-only sync failure tears down a server whose metadata already records it as running.

Additional Locations (2)

• crates/clickhousectl/src/local/mod.rs#L534-L539
• crates/clickhousectl/src/local/server.rs#L361-L364

 

^{Reviewed by Cursor Bugbot for commit 55f64f3. Configure here.}