feat(operator): bound schema migration at 20% of cron interval

[passcod]

🤖

Summary

Cap the schema-migration step at 20% of the time between consecutive cron firings. If the migration Job hasn't finished within that budget, the operator drops the persistent schemas on the new restore and proceeds with the switchover anyway. The replica comes up serving snapshot contents without the carried-over schemas; the next restore cycle re-attempts the migration if the schemas have regenerated upstream.

Rationale: a usable replica beats carrying the schema through indefinitely. Today a genuinely-stuck postgres backend on the new restore (e.g. a CREATE TABLE spinning at 100% CPU) wedges the whole replica — switchover blocks, the old Active serves increasingly stale data, every subsequent restore queues behind the wedge.

Budget

• 6-hourly cron (`0 */6 * * *`) → 72 min
• Daily cron → ~5 h
• Hourly cron → 12 min
• Falls back to 1 h if the cron expression can't be parsed.

A healthy migration takes seconds; the budget is a backstop, not a tight SLA.

Timeout behaviour

When the budget is exceeded, the operator:

1. Cancels the migration Job (background propagation).
2. Connects to the new restore and runs `DROP SCHEMA IF EXISTS CASCADE` for each `persistentSchemas` entry.
3. Records a `SchemaMigrationTimedOut` Warning event on the replica.
4. Sets `status.schemaMigrationPhase = "timeout-skipped"` so it's distinguishable from `complete` / `partial` / `failed`.
5. Proceeds with the switchover.

Shape

• New `PostgresPhysicalReplica::schema_migration_timeout()` in `replica/scheduling.rs` — parses the cron, finds two consecutive firings, returns 20% of the interval.
• New `migration_exceeded_budget(replica, job)` and `timeout_schema_migration(...)` helpers in `replica.rs`. The Active branch of the existing schema-migration reconcile checks the budget and calls the timeout helper before returning "still running".
• README: new `Persistent schemas` section documenting the budget and timeout behaviour; updated status field table to include `timeout-skipped`.

Tests

Three new unit tests covering the budget calculation:

• 6-hourly cron → 4320s
• daily cron → 17280s
• invalid cron → 3600s fallback