fix: share MySQL/OceanBase initialization and reconcile fresh seeds - #7529

Reviewed locally at 05ae928, checked against the merge base with master (76122a4). I verified the seed reconciliation statically rather than by re-running the container matrix:

• CI scripts: python3 .github/scripts/test-native-sql-matrix.py (23 tests OK) and .github/scripts/test-agent-gateway-migrations.py (10 tests OK) both pass on this head.
• Permission cleanup: all 50 removed permission rows in db/init/mysql/schema.sql reference a resource_id that does not exist in the same file's resource table (the base file had exactly 50 such orphans, the head has 0). Comparing the deleted db/init/ob/schema.sql against the reconciled MySQL seed: every OceanBase-only grant either duplicates a (role, resource) pair that already exists under a different permission id, or points at a resource that is absent from both files. So pointing OceanBase at the shared seed does not drop an effective grant.
• The two dropped plugin_handle rows (plugin 50, field prompt) are not consumed anywhere: AiProxyHandle has no prompt field, and MySQL/openGauss never shipped those rows.

Two things I would ask for before merge:

1. Please rebase. git merge-tree --write-tree gh/master <head> reports a modify/delete conflict on db/init/ob/schema.sql: master has since removed 68 orphan permission rows from that same file (the same class of cleanup). The conflict is mechanical, but the rebase needs to keep the check scripts' expectations consistent with master's ob/og seeds.
2. State the scope. This PR edits the canonical db/init/mysql/schema.sql, i.e. it changes what a fresh MySQL install gets (50 permission rows removed, plus the loggingKafka plugin row and a namespace_plugin_rel row). The title/description frame the change as an OceanBase fix, and that MySQL-visible part is easy to miss in a 2.5k-line deletion diff. Please call it out explicitly, or split it.

Also verified while diffing the seeds — shenyu_dict: the OceanBase-only DEFAULT_KEY_RESOLVER row (id 1679002911061737490, dict_name default) is not carried forward, and MySQL keeps CONTEXT_PATH_KEY_RESOLVER under that same id. Since AiTokenLimiterEnum has no default value and getByName falls back to CONTEXT_PATH, behaviour is unchanged and the guide's "unsupported default dictionary entry" note is accurate. But the H2 schema still ships DEFAULT_KEY_RESOLVER and no CONTEXT_PATH_KEY_RESOLVER, so all three schema families now disagree; a follow-up issue (or one line in the initialization guide) would keep that from being rediscovered later.

The added native-matrix checks (column/nullability, PK/index/uniqueness, orphan relations, duplicate natural keys, invalid JSON, grants and namespace defaults) are a real improvement — that is the right place to catch this class of seed regression.

Review: share MySQL/OceanBase initialization and reconcile fresh seeds

This is a well-scoped, thoroughly validated consolidation. The design is sound and the CI evidence is comprehensive.

What is correct

• Shared fresh-install source, immutable upgrade baseline. Fresh OceanBase now uses db/init/mysql/schema.sql (native-sql-matrix.py:43), while the upgrade flow still reads the historical db/init/ob/schema.sql via git show {BASELINE}:... (schema_source() at native-sql-matrix.py:51-56). Deleting the duplicate full OB schema from the tree is therefore safe — the released baseline is pinned by commit and only consumed for upgrade compatibility. This is a clean way to avoid drift between the two copies.
• Fresh-seed contract is now machine-checked. check_fresh_mysql_schema() (native-sql-matrix.py:77-140) validates tables, secondary indexes, unique constraints, referential integrity (orphan permission/resource/user_role/namespace_*_rel), duplicate natural keys, admin resource permission, default namespace plugin, and the loggingKafka bootstrapServer value. test-native-sql-matrix.py adds positive/negative coverage for both the shared-source routing and the validator. Good defense-in-depth.
• mysql/schema.sql edits match the stated reconciliation. 50 permission rows referencing absent resource_ids are removed (verified as orphans by the new validator's permission.resource_id → resource check); loggingKafka (plugin id 33) is corrected from the non-existent namesrvAddr to bootstrapServer, and its namespace_plugin_rel (id 1801816010882822171) now carries the full config aligned with the plugin row — both asserted by check_fresh_mysql_schema. All 447 effective grants are retained.
• CI repair is targeted and correct. integrated-test.yml drops the mvnd path (which silently skipped the entire subreactor and reported BUILD SUCCESS in 0.036s) in favor of the Maven wrapper with -Dmaven.test.skip=true for image construction, a docker image inspect gate before compose, and -DfailIfNoTests=true for the actual run. native-sql-matrix.py:66-69 sets --ulimit nofile=65536:65536 only for the disposable OB container, without touching host/daemon limits.
• Test-only fixture repairs are clean. The four mockStatic(LoggerFactory.class, CALLS_REAL_METHODS) changes (ExceptionHandlers/WebsocketCollector/MetaDataService/UpstreamCheckService tests), the discoveryDO.setNamespaceId addition, and the ApplicationEventPublisher mock in ProxySelectorServiceImplTest align the inherited master fixtures without altering production behavior or existing assertions.

Evidence

• pr_build, native-sql-matrix (mysql/ob/pg/og/oracle, fresh+upgrade), agent_gateway_migrations, rat_check, check-license-header, and all 21 shenyu-integrated-test-* jobs are green at head 342955c0.
• The shared-source routing and the validator are covered by new Python unit tests.

Non-blocking suggestions

• The H2 dictionary DEFAULT_KEY_RESOLVER vs CONTEXT_PATH_KEY_RESOLVER divergence is correctly documented as a separate follow-up; please keep that tracked so the H2 seed does not silently diverge further.
• Consider adding a short release note that fresh MySQL installs also change (orphan permission removal + loggingKafka field rename), since the impact is not OB-only — existing deployments must use the version-specific db/upgrade scripts, which is already called out in init-guide.md.

Approving. Nice work on the reconciliation rigor.