Bench/infra: collision-safe EC2 provisioning, harness hooks, EC2 validation runbook

[SferaDev]

What / Why

Benchmark and infra changes only — no Rust. Extracted from a longer perf session (perf/clickhouse-gap-session) that is being split into review-ready PRs.

clickbench/launch-ec2.sh — collision-safe provisioning

• Never terminates existing instances implicitly. Previously, launching with a name that matched a running instance silently terminated it — dangerous in an account where multiple people run long-lived bench boxes in parallel. Now:
  • Launch aborts with guidance to pick a unique name (--name <name>-$USER) if the name is taken.
  • Teardown requires explicit --terminate-only --name <name> — it refuses to run against the implicit default name, so you must name the instance you are destroying.
• PROFILE / KEY_NAME / KEY_FILE / NAME are env-overridable.
• Personal key-pair defaults removed from the script: KEY_NAME has no default and must be provided (clear error before any AWS call); KEY_FILE derives from it (~/.ssh/$KEY_NAME.pem), including the serial-console .pub hint.
• Hardened arg handling: --name validates a non-empty value (clean error instead of a set -u unbound-variable crash), $USER is guarded under set -u, and the account-level enable-serial-console-access call only runs in the launch path, after all abort checks — teardown and every error path make no AWS mutations.
• clickbench/Makefile: stale launch-ec2 comment (still claimed implicit termination) updated. The Makefile's own destroy-ec2 / destroy-reference-ec2 targets do their inline AWS teardown against fixed names and are unaffected.

tests/clickbench_queries.py — Q21 tie handling

Q21 added to LIMIT_TIE_QUERIES (tie column = c, index 2): at subset scales (≤10M rows) the top-10 boundary ties at c=1–2, so any tie-filler row set is a valid result. Needed for correct plain-PG vs pg_deltax result-equality checks in the local bench harness.

dev/docs/EC2_VALIDATION_PLAN.md — EC2 validation runbook

Runbook for validating the session's perf work on the full 100M-row ClickBench on c6a.4xlarge: baseline-first discipline, per-improvement measurement table, GUC A/B kill-switch discipline, official leaderboard-page generation (via the existing make bench automation), and a recorded setup gap (stock PG tuning after make setup). It references features that do not exist on main yet — partition blooms (pg_deltax.partition_bloom_filters), storage-v2 (pg_deltax.blob_storage, .dxs), merge rework — which land in sibling PRs being split from the same session; the doc carries an explicit preface note saying so, and clarifies that its #NN numbers are PERF_IMPROVEMENTS.md improvement numbers, not GitHub PRs. IPs/credentials/instance ids scrubbed (uses <ip> placeholders).

Measured numbers

None — this PR is harness/infra only; no performance claims.

Testing

• bash -n clickbench/launch-ec2.sh — clean.
• python3 -m py_compile tests/clickbench_queries.py — clean.
• Smoke-tested every pre-AWS abort path: no KEY_NAME → exit 1 with guidance; --terminate-only without --name → exit 1; --name with missing/empty value → exit 1; unknown option → exit 1 + usage. None of them reach an AWS call.
• No Rust changes, so make build/clippy/test not applicable.

Notes

• Some pre-existing environment-specific values in the script were intentionally left untouched here; clickbench: EC2 launch configuration comes from the environment #40 moves all of them out of the repository.
• Extracted from a longer perf session; net diff vs main verified to contain only the above.