feat(storage): shard every table by queue (#543)

## Summary

### Why?

An audit of all 22 `schema/*.sql` files found five tables that are not
shardable by queue: their primary key does not lead with the queue, so
one queue's rows stay reachable through another queue's binding and the
tables cannot be split across shards. The five are
`speculation_path_set`, `counter`, `request_summary`, `request_log`, and
`change_uri_request_mapping`.

Three of those — the gateway read-model tables — were declared
permanently unshardable by `submitqueue/extension/storage/storage.go`
and the schema README, on the grounds that their lookups "start from
identifiers that arrive without queue context". This change removes that
exception at its source rather than working around it: the gateway read
APIs now require the queue alongside the sqid or change URI, so the
queue is always available at the call site and no identifier ever has to
be parsed to recover one.

The five platform `messagequeue` tables are deliberately out of scope.
They are a message-queue backend keyed by `(consumer_group, topic,
partition_key)`, not a domain table set, and sharding them is a separate
problem (a global `AUTO_INCREMENT` offset, and a subscriber-heartbeat
table whose fair-leasing logic genuinely needs the whole live subscriber
set).

### What?

All 17 in-scope tables now lead their primary key with the queue.

**Independent re-keys.** `speculation_path_set` moves to `(queue, head)`
— a batch ID is unique only within its queue, so the head alone was
never a safe key. `counter` moves to `(queue, domain)` and gains the
standard extension `Config`/`Factory` shape; per the extension contract
the factory *implementations* live in the three service `main.go` files,
not under `platform/extension/`.

**Minted identifiers are unchanged.** Counter domains simplify to bare
`"request"` / `"batch"`, but every emitted ID keeps its exact current
format: `{queue}/{seq}`, `{queue}/batch/{n}`, and stovepipe's
`request/{queue}/{seq}`. Stovepipe previously reused its counter domain
*as* the ID prefix, which would have silently turned `request/queueA/7`
into `request/7`; the two are now written independently so they cannot
drift into each other. Note that re-keying `counter` restarts every
sequence at 1, so its table must be recreated in the same cutover as
`request`, `batch`, `request_summary`, and `request_log` — never on its
own, or freshly minted sqids will collide with surviving rows.

**Queue required in the gateway contract.** `CancelRequest`,
`GetRequestSummaryByIDRequest`, `GetRequestSummaryByChangeURIRequest`,
`GetRequestHistoryByIDRequest`, and
`GetRequestHistoryByChangeURIRequest` each gain a `queue` field,
validated on entry through the existing `validateQueueIdentifier`. Two
behaviour changes follow. The change-URI lookups are now scoped to one
queue, so the same URI landed into several queues needs one call per
queue. And `Cancel` no longer overrides the caller's queue with the
stored one — a mismatched queue yields `NotFound`, since a sqid is
simply not resolvable outside its own queue.

**Read-model tables re-keyed and folded in.** `request_summary`,
`request_log`, and `change_uri_request_mapping` move to queue-leading
keys and join the `Storage` aggregate; the `SetGlobalStores` seam and
the "deliberately not part of this aggregate" carve-out are deleted. The
queue travels as an explicit field on `entity.RequestLog` and
`entity.RequestURI`, stamped by producers that already know it — no ID
parsing is introduced anywhere.

**Enforcement.** A new `//tool/linter/queueshard` walks the schema
directories and fails if any primary key does not lead with the queue,
or if any secondary index does not — a non-queue-leading index would
reintroduce exactly the cross-queue access path the primary key just
closed. It is wired into `make lint`.

Schema changes are clean recreates, not online migrations, on the schema
README's statement that these tables are created empty at rollout and
never backfilled.

## Test Plan

- ✅ `make test` — 93/93 pass, including the new linter's own tests
- ✅ `bazel test //test/integration/...` — 8/8 suites pass against real
MySQL, including new cross-queue isolation coverage in the counter,
storage, request-URI and request-log contract suites
- ✅ `bazel test //test/e2e/...` — both suites pass against the full
Docker Compose stack (land → landed, plus status/history/cancel/list
through the queue-scoped APIs)
- ✅ `make lint` — fmt, license headers, and `queueshard` ("All 17 tables
are shardable by queue")
- ✅ `make fmt` / `make gazelle` / `make mocks` / `make tidy` — no drift

The e2e and image-building integration targets need
`--sandbox_writable_path=$HOME/.docker` when run locally; `make
e2e-test` does not pass it, which is a pre-existing local-only issue
unrelated to this change.

Author: behinddwalls

Makefile

@@ -172,7 +172,7 @@ integration-test-submitqueue-orchestrator: ## Run Orchestrator integration tests
 license-fix: ## Add missing license headers to source files
 	@$(BAZEL) run //tool/linter/licenseheader -- --fix
 
-lint: lint-fmt lint-license ## Run all linters
+lint: lint-fmt lint-license lint-queue-shard ## Run all linters
 	@echo "All lint checks passed."
 
 lint-fmt: fmt ## Check code formatting (fails if unformatted)
@@ -182,6 +182,9 @@ lint-fmt: fmt ## Check code formatting (fails if unformatted)
 lint-license: ## Check license headers on all source files
 	@$(BAZEL) run //tool/linter/licenseheader -- --check
 
+lint-queue-shard: ## Check every table's primary key leads with the queue column
+	@$(BAZEL) run //tool/linter/queueshard
+
 local-submitqueue-clean: ## Stop and remove all local services, volumes, and images
 	@echo "Cleaning all services and data..."
 	@$(COMPOSE) -f $(COMPOSE_FILE) -p $(SUBMITQUEUE_LOCAL_PROJECT) down -v --rmi local

api/submitqueue/gateway/proto/gateway.proto

@@ -74,6 +74,9 @@ message CancelRequest {
     string sqid = 1;
     // Optional human-readable reason for the cancellation. Recorded for observability.
     string reason = 2;
+    // Name of the queue processing the request. Required. A sqid is only resolvable within its own queue,
+    // so naming a queue the request does not belong to is reported as not found.
+    string queue = 3;
 }
 
 // CancelResponse defines the response to a cancel request. Empty on success.
@@ -106,6 +109,9 @@ message RequestSummary {
 message GetRequestSummaryByIDRequest {
     // Globally unique identifier for the request.
     string sqid = 1;
+    // Name of the queue processing the request. Required. A sqid is only resolvable within its own queue,
+    // so naming a queue the request does not belong to is reported as not found.
+    string queue = 2;
 }
 
 // GetRequestSummaryByIDResponse contains the current materialized request view.
@@ -118,6 +124,9 @@ message GetRequestSummaryByIDResponse {
 message GetRequestSummaryByChangeURIRequest {
     // Exact change URI supplied in a Land request.
     string change_uri = 1;
+    // Name of the queue to search. Required. Results are scoped to this queue: a change URI landed
+    // into several queues is looked up one queue at a time.
+    string queue = 2;
 }
 
 // GetRequestSummaryByChangeURIResponse contains matching requests newest first.
@@ -152,6 +161,9 @@ message ListResponse {
 message GetRequestHistoryByIDRequest {
     // Globally unique identifier for the request.
     string sqid = 1;
+    // Name of the queue processing the request. Required. A sqid is only resolvable within its own queue,
+    // so naming a queue the request does not belong to is reported as not found.
+    string queue = 2;
 }
 
 // HistoryEvent is one retained append-only request-log event.
@@ -176,6 +188,9 @@ message GetRequestHistoryByIDResponse {
 message GetRequestHistoryByChangeURIRequest {
     // Exact change URI supplied in a Land request.
     string change_uri = 1;
+    // Name of the queue to search. Required. Results are scoped to this queue: a change URI landed
+    // into several queues is looked up one queue at a time.
+    string queue = 2;
 }
 
 // RequestHistory groups retained events for one request.