Make functions schema-safe via pinned search_path

When the extension was installed into a non-default schema, calling its
functions failed with "relation ... does not exist" unless the caller
happened to have that schema on their search_path. The SECURITY INVOKER
functions referenced their tables unqualified and inherited whatever
search_path the session had.

Pin search_path = @extschema@, pg_temp on every function and procedure
(the SECURITY DEFINER helpers already did this), so they always resolve
the extension's own tables regardless of the caller's search_path. Also
grant pgos_admin USAGE on the install schema so the SECURITY DEFINER
locking helpers can reach those tables outside the public schema (PUBLIC
only receives that USAGE for public automatically).

Adds a schema_install regression test that installs into a dedicated
schema, drops that schema from the search_path, and exercises the
user/process/memory/file and mutex paths through fully-qualified calls.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ty3Rkif9Vfe95w8TMiKB4b

Author: claude

Makefile

@@ -13,7 +13,8 @@ REGRESS = pg_os_basic \
           lock_file \
           load_unload_module \
           modules \
-          locks_security
+          locks_security \
+          schema_install
 REGRESS_OPTS = --outputdir=$(CURDIR)/tmp_pg_os_regress
 PGXS := $(shell $(PG_CONFIG) --pgxs)
 include $(PGXS)

expected/schema_install.out

@@ -0,0 +1,75 @@
+-- The extension must work when installed into a non-default schema and called
+-- WITHOUT that schema on the search_path. Every function pins its own
+-- search_path to @extschema@, so qualified calls resolve their tables.
+\set ECHO none
+SELECT pgos_ext.create_user('alice') AS uid 
+SELECT pgos_ext.create_role('ops') AS rid 
+SELECT pgos_ext.assign_role_to_user(1, 1);
+ assign_role_to_user 
+---------------------
+ 
+(1 row)
+
+SELECT pgos_ext.grant_permission_to_role(1, 'process', 'execute');
+ grant_permission_to_role 
+--------------------------
+ 
+(1 row)
+
+SELECT pgos_ext.grant_permission_to_role(1, 'memory', 'allocate');
+ grant_permission_to_role 
+--------------------------
+ 
+(1 row)
+
+SELECT pgos_ext.grant_permission_to_role(1, 'file', 'write');
+ grant_permission_to_role 
+--------------------------
+ 
+(1 row)
+
+CALL pgos_ext.create_process('p1', 1, 1);
+SELECT name, state FROM pgos_ext.processes ORDER BY name;
+ name | state 
+------+-------
+ p1   | new
+(1 row)
+
+INSERT INTO pgos_ext.memory_segments (size) VALUES (4096);
+SELECT pgos_ext.allocate_memory(1, 1, 1024);
+ allocate_memory 
+-----------------
+ 
+(1 row)
+
+SELECT allocated, allocated_to FROM pgos_ext.memory_segments ORDER BY id;
+ allocated | allocated_to 
+-----------+--------------
+ t         |            1
+(1 row)
+
+SELECT pgos_ext.create_file(1, 'f.txt', NULL, FALSE) AS fid 
+SELECT pgos_ext.write_file(1, 1, 'hi');
+ write_file 
+------------
+ 
+(1 row)
+
+SELECT pgos_ext.read_file(1, 1);
+ read_file 
+-----------
+ hi
+(1 row)
+
+SELECT pgos_ext.create_mutex('m');
+ create_mutex 
+--------------
+ 
+(1 row)
+
+SELECT name, locked_by_thread FROM pgos_ext.mutexes;
+ name | locked_by_thread 
+------+------------------
+ m    |                 
+(1 row)
+