[default values] Handshake and drop read-bridge overlays on the server

[cbb330]

Summary

Depends on #674 (policy), stacked on #668 → #645. #679 (ReadBridge.apply) restacks on this PR.

Read-bridge overlays must not persist. This PR puts the drop on the server before apply lands, so there is no deployable cut where overlays are applied but not stripped.

Default-aware clients send initial-default on stamped field-ids (the handshake). The server gates Type 1 / Type 2, then strips those keys before Iceberg commit. Unstamped ids keep the writer's defaults.

Until #679, apply is still a no-op; PUTs only carry initial-default if the writer set it. The server is already safe: drop is a no-op when the handshake is absent, and Type 2 fail-closes unaware rewrites on ramped tables.

How strip protection works

Gate	When	Result
Type 1	Ramped table; a previously stamped field-id is still in the schema but missing from incoming stamps	400 COLUMN_DEFAULT_REMOVED
Type 2	Ramped rewrite (replace / overwrite on main) while previous stamps are nonempty	400 COLUMN_DEFAULT_REWRITE unless each remaining id's initial-default JSON equals the stamp
Unusable	Ramped write; source throw / unreadable schema / unreadable snapshots	400 COLUMN_DEFAULT_UNUSABLE
Drop	After gates pass	Remove initial-default on stamped ids (same findParents("id") walk as the client)

Unramped tables are a no-op. GET resolve() still fail-opens; only the write path is fail-closed. Awareness is JsonNode.equals against the stamped config, not key presence.

OSS never parses ASL. ColumnDefaultsSource is the seam (NONE in OSS); LinkedIn fills it. Type 1 compares stamped field-id sets from the resolver.

Changes

• New Features — ReadBridgeStripProtection.prepare on PUT table / snapshots
• Internal API Changes — resolver write APIs stampedColumnDefaults / isRampedForCommit
• Tests — unit Type 1/2/unusable, mock bean for MockTablesApplication, HTTP e2e that GET initialDefault() is null after overlay PUT

Testing Done

• Added new tests for the changes made.
• Updated existing tests to reflect the changes made.
• Local (Java 17): ./gradlew :services:tables:test --tests '*ReadBridgeStripProtectionTest' --tests '*ReadBridgeConfigResolverTest' --tests '*ReadBridgeColumnDefaultE2ETest'

Additional Information

• Large PR broken into smaller PRs, and PR plan linked in the description.

Stack

1. #645 — substrate (seam + encode + decode hook)
2. #668 — decode off Iceberg’s retry path
3. #674 — policy / ramp in OpenHouse
4. This PR — handshake on PUT, Type 1/2, drop before persist
5. #679 — ReadBridge.apply (merge after this PR)
6. #681 — Spark catalog itest (overlay)

Rollback Plan

Revert this PR. After #679, clients send overlays; without the server drop they persist in Iceberg metadata.