Make functions schema-safe via pinned search_path

[seanwevans]

Problem

Installing the extension into a non-default schema and then calling its functions failed unless the caller's search_path happened to include that schema:

CREATE EXTENSION pg_os WITH SCHEMA os;
SET search_path = public;
SELECT os.create_user('alice');
-- ERROR: relation "users" does not exist

The SECURITY INVOKER functions referenced their tables unqualified and inherited whatever search_path the session had.

Fix

• Pin SET search_path = @extschema@, pg_temp on every function and procedure (the SECURITY DEFINER helpers already did this), so they always resolve the extension's own tables regardless of the caller's search_path.
• GRANT USAGE ON SCHEMA @extschema@ TO pgos_admin so the SECURITY DEFINER locking helpers can reach those tables outside public. PUBLIC only receives that USAGE for the public schema automatically, so without this create_mutex etc. failed with "relation mutexes does not exist" in a custom-schema install.

Test

Adds a schema_install regression test that installs into a dedicated schema, removes that schema from search_path, and exercises the user/role/process, memory, filesystem and mutex paths through fully-qualified calls. Suite is green (14/14 on this branch).

🤖 Generated with Claude Code

---

Generated by Claude Code