[#33444] DocDB: Add retention-pin observability for index-backfill ordering generations

[jmeehan16]

Summary

Retention-pin observability for deferred unique-index verification (#33444). With #33655
enforcing the retention barrier as a history read fence, an orphaned active ordering
generation pins ALL history GC on its tablet -- previously findable only by reading tablet
superblocks. This was called out as a measurement-gate requirement in the read-fence review:
the rollout's retained-history measurements need these signals. Two server-level tserver
gauges, updated by the existing 1s EmitMetrics poller:

• ts_index_backfill_pinned_tablets -- tablet peers whose history GC is pinned by an active
  index-backfill ordering generation. Counts peers in any state: the pin is on-disk
  metadata, not runtime state.
• ts_index_backfill_oldest_retention_barrier_age_ms -- age of the oldest active barrier,
  clamped at zero (the barrier derives from a master-chosen read time, which clock skew can
  put slightly ahead of this server's clock right after activation). 0 when no generation is
  active or no active generation carries a barrier hybrid time -- that missing-barrier state
  blocks all history GC on its tablet and already logs a warning every 30s.

Alerting guidance: key alerts on ts_index_backfill_pinned_tablets > 0 persisting
longer than the expected build+verify duration -- never on age alone. The worst state (an
active generation with a missing barrier) blocks all history GC yet reports age 0; the
pinned count plus the tserver's periodic missing-barrier warning are the signals that cover
it.

The tserver /tablet detail page additionally shows a held generation's fields (index
table, base op index, write-ID floor version, retention barrier + age) for per-tablet
triage.

Stacked on #33403, #33404, #33484, #33544, #33553, #33580, #33584, #33601, #33602, #33654,
#33655, and #33656, based on feature-stack/Shopify/uniq-idx-7-fail-closed-gate per the
feature-stack workflow, so the diff is exactly this PR's own commit. A failing pr-title
check on stacked PRs is a known gap in that check; the stack merges bottom-up and retargets
as parents merge.

Upgrade/Rollback safety

A non-event: no wire, persisted-format, RPC, or flag changes -- two new server-level gauges
and a web-UI section, all reading existing tablet metadata. Old and new tservers coexist
freely; rollback simply stops exporting the metrics.

Test plan

macOS arm64, release -- all green:

• New: FixedHybridTimeWriteIdITest.RetentionPinMetricsTrackActiveGenerations --
  deterministic gauge semantics via directly-set generations, on every replica: baseline
  zero, pinned count with a barrier placed 5s in the past (age floor asserted with
  slack), the missing-barrier edge (pinned = 1 with age = 0), and release clearing both.
• New: PgIndexBackfillVerifier.RetentionPinMetricsReflectHeldGeneration/0 -- end-to-end
  wiring under the real activation path: with the funnel's release blocked, all three
  tservers report the pin and a positive age.
• New: PgIndexBackfillVerifierReleased.RetentionPinMetricsClearOnRelease/0 -- gauges
  return to zero after the production release path runs.
• Regressions: FixedHybridTimeWriteIdITest.MissingBarrierBlocksAllHistoryGC,
  FixedHybridTimeWriteIdITest.RetentionBarrierPreservesSupersededWindowVersions. All
  three new tests re-run after the review round (HTML escaping + shared age helper).

AlmaLinux (x86_64, clang21) -- all green (this PR is the stack tip, so every run below
is at its own commit c69686cd0d):

• TSAN/ASAN/debug: fixed_hybrid_time_write_id-itest (carries
  RetentionPinMetricsTrackActiveGenerations), tablet_peer-test,
  unique_index_verifier-test; TSAN non_transactional_batch_writer-test.
• ASAN + debug: both new pg_index_backfill-test tests, both params, isolated
  (RetentionPinMetricsReflectHeldGeneration, RetentionPinMetricsClearOnRelease).
• ASAN + debug + release: full pg_index_backfill-test.
  The single debug-build pg_index_backfill-test failure across these runs is
  PgIndexBackfillBackendsManager.NoAbortTxn/1 (GetSafeTime 60s timeout), the pre-
  existing upstream flake: it fails 3/3 at a base commit carrying none of this stack's
  code, and has upstream hardening lineage ([YSQL] test: harden YSQL backends manager tests #19351).
• Metrics-emission blast radius (EmitMetrics now walks every peer's generation state):
  ASAN remote_bootstrap-itest, clone-tablet-itest, tablet_bootstrap-test,
  docdb-test, pg_txn-test; debug snapshot-test, tablet_snapshots-test,
  remote_bootstrap-itest, xcluster_external_apply_bootstrap-test.