CAS: retry the mount lease renewal until the store answers

[filimonov]

The background renewal of the CAS mount lease gave up 4 s after it was due. The give-up fenced the mount and forced a remount under a fresh epoch (36.5 s or more), so an 8-second burst of 503 cost a full remount cycle. The renewal now retries until the store gives a definitive answer; the holder's own timer alone decides when writes stop, and they resume under the same writer_epoch when a renewal succeeds and leaves enough lease.

Changes

• The background renewal retries one immutable request about once a second until the store answers, a stop or a remount request. It runs on its own request plane, so a latched fence cannot refuse the renewal that restores the lease.
• An expired lease is visible: lifecycle_reason = 'lease_expired' in system.cas_mounts, the event CASMountLeaseExpired, expired_ms in the watermark_renew event, one WARNING per expiry.
• GC dates a sighting of a mount token after the read that returned it. Before, a slow round could fence a holder that still had authority.
• A memory-limit exception no longer ends the lease thread; a conditional PUT runs on the calling thread with a buffer of the body size.

Risks / notes

• Write admission is unchanged: a conditional write still needs 2 × envelope + margin (16 s with defaults) of remaining lease, so writes are refused from about 4 s into a renewal outage, with a transient NETWORK_ERROR, until a renewal lands.
• A GC leader on another pool member still fences a silent server after its observation threshold, and a definitive answer of the store still ends the mount.
• One control-plane attempt is not bounded by a wall-clock deadline (per-socket-operation timeouts only). Not changed here.

Testing

• Unit: CAS* gate, 2605 tests in release, 2609 under ASan with no error.
• Integration: test_cas_mount_renewal_retry (test_short_put_outage_does_not_fence, test_long_put_outage_resumes_under_the_same_epoch), both red on the base.

Closes: #2431
Closes: #2403

Changelog category (leave one):

• Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Fix a CAS mount lease being fenced, with a remount under a fresh epoch and a long wait, after a short object-store outage on the lease renewal. The renewal now retries until the store answers. Writes are refused while the remaining lease cannot cover them or has expired, and resume under the same writer_epoch once a renewal succeeds and leaves enough lease. A GC leader on another member or a definitive store answer still ends the mount. Add the CASMountLeaseExpired event and the lease_expired lifecycle reason in system.cas_mounts. Fix GC counting its wait for a mount token from before it saw the token, and the memory tracker failing the lease thread.

Documentation entry for user-facing changes

• Documentation is written (mandatory for new features)

Updated docs/en/antalya/cas/architecture/mounts-and-leases.md, docs/en/antalya/cas/configuration.md, docs/en/antalya/cas/operations/troubleshooting.md, docs/en/antalya/cas/operations/monitoring.md, docs/en/antalya/cas/operations/debugging.md and docs/en/operations/system-tables/cas_mounts.md.

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [e1c38ca]