fix(activation): preload httpfs + S3 secret before iceberg LOAD

[benben]

Problem

Iceberg-only tenant activation (no DuckLake) hangs ~60s at LoadExtensions("iceberg") and trips the activate-tenant deadline. Iceberg + DuckLake ("both") activates through the same code in ~120ms.

Why

Loki worker logs (ben-ext-both on the current build):

step=count-catalogs                 elapsed=107ns
step=load-iceberg-extension         elapsed=1.4ms
"Loaded extension." extension=iceberg          ←  ~121ms after step start
step=create-s3-data-secret          elapsed=122ms
…
"Attached Iceberg catalog successfully."

vs ben-ext-ice:

step=count-catalogs                 elapsed=164ns
step=load-iceberg-extension         elapsed=2.0ms
… (no further activity for ~60s) …
"Shutting down DuckDB service..."

The difference is what runs before LoadExtensions("iceberg"):

• "both" runs AttachDuckLake first. That auto-loads httpfs and creates a TYPE S3 secret (ducklake_s3) for the DuckLake data plane. By the time AttachIcebergCatalog runs, iceberg's LOAD-time init finds httpfs loaded and an S3 secret on hand.
• iceberg-only skips AttachDuckLake. When LoadExtensions("iceberg") runs there's no httpfs loaded and no S3 secret to discover, so iceberg's init falls back to AWS-SDK credential discovery → IMDS probe at 169.254.169.254. The cluster-wide duckgres-worker-egress egressDeny block on 169.254.0.0/16 (defense-in-depth so workers can't escalate via the node IRSA) drops the probe, which blocks until the activate-tenant deadline kills the worker — with no Go-level log, which is why the stall is invisible in plain worker output.

Fix

Mirror the DuckLake setup minimally in both iceberg attach paths:

LoadExtensions(db, []string{"httpfs"})           // bundled, ~ms
db.Exec(iceberg.BuildIcebergSecretStmt(...))     // TYPE S3 secret
LoadExtensions(db, []string{"iceberg"})          // now skips IMDS, ~120ms

With a TYPE S3 secret already registered at LOAD time, iceberg's init takes the configured-credential path and skips IMDS discovery. Activation completes within the deadline.

Test plan (mw-dev after deploy)

• ben-ext-ice / ben-cnpg-ice / ben-aur-ice all activate within the deadline.
• Iceberg-only SELECT 1 succeeds; CREATE TABLE iceberg.public.<t> / INSERT / SELECT round-trips.
• "both" combos remain green.

🤖 Generated with Claude Code