adapter: don't leak arrangement compression into the realized config - #38112

`ManagedClusterIds` and the sequencer's two ownership tests excluded
system/builtin clusters, so the sequencer kept a second, complete
replica-materialization implementation alive just for them. The exception was
originally load-bearing (the boot-time builtin replica migration and the
controller would have been two conflicting writers), but
`reconcile_builtin_cluster_replicas` now converges a builtin cluster's replica
set on the cluster's own managed config, the same config the controller derives
its targets from, so the two converge by construction.

Drop the `is_user()` conjuncts. Runtime ALTERs of system clusters now flow
through the controller like any other managed cluster: a config-shape change
reshapes into a durable reconfiguration record, a factor change updates the
config and the controller converges the replica set within a tick.

The boot migration and the controller compose in both directions. The
controller matches replicas by shape and count, never by name, so the
migration-created `r1..rN` satisfy its baseline. The migration converges by
canonical name, so a boot after a reshape renames or re-creates replicas the
controller materialized under generator names, which is harmless churn on
processes that are cold at boot anyway.

With the controller owning every managed cluster's replica set,
`NeedsFinalization::Yes` has no producer. Delete the machine it drove: the
`WaitForHydrated` and `Finalize` stages, the `-pending` overlap replicas, the
`pending_cluster_alters` connection state and its retire paths, and the
`AlterClusterWhilePendingReplicas` error.

The direct reshape path is deliberately kept, as the synchronous cut-over. It
is now routed to by an explicitly zero-timeout commit strategy
(`WITH (WAIT FOR '0s')`, or `WAIT UNTIL READY (TIMEOUT '0s', ON TIMEOUT
'COMMIT')`) rather than by the absence of a `WAIT` clause. Two reasons. It is
the escape hatch: every other reshape depends on the controller ticking and
applying, and this is the one that still works when the controller itself is
the problem, while also unsticking a wedged reconfiguration by retiring its
record. And the semantics are honest: a zero timeout with commit already means
"cut over now, hydrated or not", so doing it synchronously in the ALTER is the
same outcome minus a tick.

"The same outcome" has to be true, so the cut-over does not improvise. It
folds its target onto an in-flight one exactly as the reshape path does, and it
converges the replica set with the controller's own reconcile kernel, so a
replica that already has the target shape is kept rather than bounced. Forcing
a stuck-but-hydrating resize to commit therefore keeps the replica that was
already up, and lands the record on `finalized` (forced) rather than
`cancelled`, since the cut-over reached the record's own target.

Creating a replica from the controller's `ReplicaShape` also drops a lossy
round-trip through the planner's `ComputeReplicaConfig`, which cannot represent
`INTROSPECTION DEBUGGING` without an interval. A cluster in that state used to
get a replica whose logging disagreed with the config that called for it.

Follow-ups on deleting the staged reconfiguration machine, no behavior
change.

Collapse the cut-over routing's bool-plus-Option pair into a single
optional cut-over target, computed unconditionally on that path. The fold
with nothing in flight returns exactly the statement's shape, so applying
it is the identity and the "nothing in flight, nothing to fold" special
case disappears. The cut-over now computes its target through the same
call the reshape path makes, so the two agreeing is structural rather
than commented.

Applying a target onto a managed config is the inverse of
`realized_reconfiguration_target`, so it moves next to it in objects.rs
as `apply_reconfiguration_target`, keeping the exhaustive-destructure
compile guard beside the type it guards.

`sequence_create_managed_cluster` builds the one `ReplicaShape` all its
replicas share once, instead of a separate logging binding plus a
per-iteration shape construction in the loop.

Also fix the `sequence_alter_cluster_managed_to_managed` doc, which
claimed the carried record is retired as cancelled and the replica set
dropped wholesale: `retire_carried_reconfiguration` settles an on-target
record as finalized (forced), and the reconcile keeps already-matching
replicas.

Graceful cluster reconfiguration has been behind the
`enable_zero_downtime_cluster_reconfiguration` feature flag, default off, so the
`WITH (WAIT ...)` surface was rejected at plan time unless a deployment turned
it on. That is now the only thing standing between an operator and the
synchronous cut-over, which is the escape hatch for a reshape when the cluster
controller itself is the problem. A break-glass path behind a default-off flag
is not a break-glass path.

Remove the flag and the planner gate. The two rejections that share that code
path stay: a `WAIT` without a replica-shape change, and a `WAIT` on an
unmanaged cluster.

Every test that used the surface enabled the flag itself, so those statements
go. In a mixed-version run some phases execute against a released binary that
still enforces the gate (platform-checks' graceful-reconfiguration check runs
its first manipulate phase there), so `get_minimal_system_parameters` pins the
flag on below v26.38 instead.

The docs drop the private-preview badges: the surface is generally available
once nothing gates it.