Add a DSN-driven harness that provisions isolated sample databases and
roles, seeds the Bytebase sample HR schema, replays Bytebase-like sync,
DDL, and interactive workloads, records measurements, and removes
everything it created. Phase 1 runs the matrix against local Postgres via
testcontainers; a CLI entrypoint is included for the Cloud SQL leg.

Includes the agreed workload assumptions and pass/fail thresholds in the
README.

Cloud SQL's postgres user is a restricted superuser that cannot SET ROLE,
transfer database ownership, or drop databases it does not own. Provisioning
with CREATE DATABASE ... OWNER therefore fails. Change the model to: the
admin owns each database and the workspace role is a least-privilege CONNECT
+ SELECT role (provision/seed/sync/DDL as admin, interactive queries as the
role).

Also harden the harness for re-runs and flaky networks: connect_timeout on
all DSNs, a best-effort pre-run cleanup of the name prefix, an empty-tenants
guard in the orchestrator, a -verbose flag, and PGPASSWORD env fallback so
the password is not exposed in argv.

The report marshaled Config and Tenant verbatim, leaking the admin password,
per-tenant passwords, and the 570 KB seed SQL into the report and serial
console. Exclude AdminPassword, SeedSQL, and Tenant.Password from JSON.

Run sync, interactive, and DDL simultaneously, each with one worker or
session per database, instead of the capped/sequential phases. This models
the worst case where every workspace is syncing, querying, and applying DDL
at the same time, exposing the instance's CPU/RAM ceiling rather than the
connection limit.

…ures

Sync and change-ticket DDL now connect as each workspace's per-database
role and are capped at a modest realistic overlap (default 10 and 5
concurrent) instead of an N-wide pool that treated sync as one
coordination point syncing every database as admin. Interactive
concurrency is held fixed (10 steady / 50 burst) while database count
varies. Seed transfers ownership of the public schema and its objects to
the tenant role so role-scoped DDL works; serial-owned sequences follow
their table. Also rename loadSampleData to loadSampleDataFromFS to
silence the revive confusing-naming lint.

…before drop

Cloud SQL's postgres user is not a superuser (rolsuper=false) and cannot
SET ROLE or transfer ownership of objects it creates, so a role can only
own what it creates itself. Seed each tenant database as the tenant role
(after the control plane grants CREATE ON DATABASE and ON SCHEMA public)
instead of seeding as admin and trying to transfer ownership, which fails
with 'must be able to SET ROLE'.

Cleanup now connects as the tenant role to terminate its lingering
backends before DROP DATABASE WITH (FORCE), modeling the 7-day expiry:
postgres cannot terminate another role's processes, so FORCE alone races
with session teardown at scale and leaves orphaned databases and roles.

Backend termination is asynchronous: a backend can linger for a moment
after its client socket closes, and dropping the database in that window
fails because Cloud SQL's postgres user cannot terminate another role's
processes. After terminating the role's backends, poll pg_stat_activity
until the database has no backends, then drop with a bounded retry. The
retry also covers a backend that appears between the drain check and the
drop. Validated on Cloud SQL: the 70/500/1000 matrix completes with zero
cleanup failures and no orphaned databases or roles.

The per-workspace sync model spawns one worker per database and runs all
workers concurrently, each syncing its own database as its own
per-database role (the worst case where every workspace syncs at once).
The previous 10-concurrent cap was a misreading of the handoff and
understated sync load. Drop the now-dead SyncConcurrency knob; DDL (5)
and interactive (10/50) concurrency are unchanged.