Make local Postgres startup transactional

[sdairs]

Summary

• Split fresh Postgres container creation from start so every error after creation has a container ID and crosses one rollback boundary.
• On start, metadata, or readiness failure, force-remove the container and metadata, then remove PGDATA only when the instance directory was absent or empty before the attempt. Preserve pre-existing and resumed data, and retain data when container removal fails.
• Preserve the primary startup error while appending actionable cleanup diagnostics.
• Add deterministic fake-Docker and temporary-filesystem coverage for start failure, initialization timeout, metadata failure, clean retry, cleanup failure, pre-existing data, and resume failure.

Tests

• cargo test -p clickhousectl (762 passed)
• cargo test -p clickhousectl --test local_postgres_readiness_test (9 passed)
• cargo test -p clickhousectl local::postgres::tests::fresh_ (2 passed)
• cargo clippy -p clickhousectl --all-targets -- -D warnings (passed)
• cargo build -p clickhousectl (passed)
• cargo fmt --all -- --check (passed)
• CI local postgres edge cases Docker integration (passed)
• Local Docker integration not run: the configured OrbStack daemon socket was unavailable

Stack

Position 3 of 3 (top), based on #498.

• Validate local Postgres start options before Docker work #486 validates local Postgres start options before Docker work.
• Wait for PostgreSQL readiness before local start success #498 waits for PostgreSQL readiness before reporting startup success.
• This PR makes fresh startup transactional across Docker start, metadata persistence, and readiness.

Closes #464

[macroscopeapp]

🔴 Critical

clickhousectl/crates/clickhousectl/src/local/postgres.rs

Line 363 in b59d95a

if let Err(error) = docker::remove_host_dir_blocking(&rollback.instance_dir) {

Rollback can execute shell metacharacters from a user-controlled server name and delete other Postgres instances under the mounted servers directory. instance_dir reaches remove_host_dir_blocking, whose sh -c "rm -rf /work/{basename}" fallback does not quote the basename; use a non-shell deletion path or safely pass the directory as an argument.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @crates/clickhousectl/src/local/postgres.rs around line 363:

Rollback can execute shell metacharacters from a user-controlled server name and delete other Postgres instances under the mounted `servers` directory. `instance_dir` reaches `remove_host_dir_blocking`, whose `sh -c "rm -rf /work/{basename}"` fallback does not quote the basename; use a non-shell deletion path or safely pass the directory as an argument.