[ibrahim halatci (ihalatci)]

DESCRIPTION: Uses a trusted search path for internal SPI queries

Stacked on #8954; this PR contains only the trusted-search-path layer for main, ported from #8944.

Use the existing PushEmptySearchPath()/PopEmptySearchPath() helpers around internal SPI execution in ExecuteQueryViaSPI, TableEmpty, ExecuteCommandAsSuperuser, EnsureParentSessionHasExclusiveLockOnPgDistNode, and LockAcquireHelperMain. This prevents caller-controlled operator lookup while retaining the helpers' existing error/GUC restoration behavior.

Add the adversarial oid-equality regression force_search_path_in_execute to multi_1_create_citus_schedule and update affected schema-qualified expectations, including citus_local_tables_mx. No SQL migration, privilege, version, or packaging changes.

Validation on PostgreSQL 18.6 in isolated WSL source/runtime directories, using main plus #8954 and this layer:

• ./configure — passed.
• make -s -j8 — passed.
• make -s install-all — passed.
• make -s -C src/test/regress check-minimal EXTRA_TESTS='multi_behavioral_analytics_create_table force_search_path_in_execute alter_distributed_table alter_table_set_access_method merge undistribute_table' — passed 12/12.
• make -s -C src/test/regress check-multi-mx — passed 69/69, including citus_local_tables_mx.
• make -s -C src/test/regress check-multi-1 — passed 210/210.
• uncrustify -c <pinned-tools-0.8.33>/etc/citustools/citus-style.cfg --check src/backend/distributed/commands/alter_table.c src/backend/distributed/commands/create_distributed_table.c src/backend/distributed/metadata/distobject.c src/backend/distributed/metadata/node_metadata.c src/backend/distributed/utils/acquire_lock.c — passed with Uncrustify 0.82.0.
• bash ci/normalize_expected.sh and bash ci/sort_and_group_includes.sh — no content changes.
• git diff --cached --check — passed; all 13 changed files match the validated Linux sources after line-ending normalization.

Negative control: make -s -C src/test/regress check-minimal EXTRA_TESTS='force_search_path_in_execute' against an independently built, unchanged #8954 parent fails as expected: 107 untrusted operator calls instead of 0. With this layer the count is 0.

The initial focused invocation omitted multi_behavioral_analytics_create_table and failed alter_distributed_table's colocation expectation; the documented prerequisite was restored for the passing 12/12 run above.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.81%. Comparing base (9ab712e) to head (6734dfc).

Additional details and impacted files

@@                              Coverage Diff                              @@
##           ihalatci-main-metadata-cleanup-authorization    #8955   +/-   ##
=============================================================================
  Coverage                                         88.81%   88.81%           
=============================================================================
  Files                                               290      290           
  Lines                                             65502    65512   +10     
  Branches                                           8261     8261           
=============================================================================
+ Hits                                              58176    58185    +9     
  Misses                                             4941     4941           
- Partials                                           2385     2386    +1     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.