GS: ClickHouse 26.8+ commit-cursor append refresh

まず docs/design/google-sheets/append-refresh.md と docs/design/google-sheets/decisions.md を読み、次に依存関係 #400、#401、#402 を確認します。記載されている受け入れ基準を使って完了条件を定義します。これには、capability-gated validation、永続的なパーティションチェックポイント、上限付きの refresh ページ、正確な Google コミット、再開動作、および無効な状態に対する明示的な full-refresh の処理を含めます。

Parent: #398
Depends on: #400, #401, #402

Design:

• docs/design/google-sheets/append-refresh.md
• docs/design/google-sheets/decisions.md

Scope

Implement capability-gated append-only refresh for eligible direct MergeTree/ReplicatedMergeTree sources using per-partition persistent _block_number and _block_offset checkpoints and finite bounded SELECT queries.

Acceptance criteria

• Append UI requires configured minimum version (initially 26.8) and successful runtime capability probes.
• Eligible query validation permits one deterministic direct source and rejects joins, views, FINAL, aggregation, DISTINCT, window functions, UNION, table functions, and business LIMIT.
• Binding pins table UUID, query hash, schema hash, source-subset parameters, and initialization mode.
• Initial modes support history export and future-only checkpoints.
• Refresh captures finite per-partition upper boundaries.
• Pages are ordered and filtered by _block_number / _block_offset and use decimal-string UInt64 values.
• Each Google commit copies exact staged rows and advances only the corresponding partition checkpoint in the same publication batch.
• A closed tab resumes from the last committed page without duplicates.
• Invalid capability, UUID, query, schema, parameter, row-count, or checkpoint state requires explicit full refresh.
• SELECT ... STREAM, updates, deletes, and silent fallback are absent.

Concurrency

Use advisory lease metadata and generation rechecks. Strict distributed locking is out of scope.