fix(schema): rename struct Data -> XceData to unshadow capnp builtin blob type

controller.capnp declared `struct Data $C.mapname("xce_data_t")` (an
OPCode_get query-result tagged union) at file scope, which shadows
Cap'n Proto's builtin Data blob type for every later `: Data` field in
the same file. This silently miscompiled 7 fields across 6 structs as
a struct-pointer type instead of a raw byte blob: UpgradeConfigRequest
.sha256/.bytes, ReplConfigReply.sha256/.bytes, ReplConfigPushRequest
.sha256/.bytes, ReplEnvelope.payload, SnapshotTransfer's chunk
payload, WalCatchupEntry.payload/.batchPayloads, and CtrlHelloRequest
.key. Production C code had already routed around it for years via
hand-rolled raw capn_ptr manipulation (see request.c's own comments);
nothing before now needed the generated codec/accessors to actually
work for these fields.

Renamed the local struct to XceData (capnp-level name only; the
$C.mapname("xce_data_t") C typedef is unchanged) and explicitly
repointed getdata/pushmsg at XceData by name, since those two fields
correctly want the local tagged union. Updated every derived
generated-identifier reference across 19 hand-written files spanning
controller, lib, scheduler, and the Go apiserver/xcecli CGo bindings.
Fixed 5 call sites in lib/request.c that had been typed against the
old workaround alias but now legitimately receive the correct
capn_data type (a pure type-name swap -- Data_ptr/XceData_ptr and
capn_data share the identical {capn_ptr p} layout).

Verified via full rebuild+test: lib (1/1), controller (3/3, incl. the
job-array push regression tests), scheduler (15/15), Go apiserver +
xcecli (all packages green), and a direct pycapnp round-trip proving
UpgradeConfigRequest.sha256/.bytes now encode/decode correctly.

Bug: bug-1461 (.wolf/buglog.json). Unblocks admin-config-tool task 3.3.

src/frontend/apiserver/backend/clib.go

@@ -229,7 +229,7 @@ func handlePush(req *C.xce_request_t) C.int {
 // handleDataset processes a dataset push (jobs or workers).
 func handleDataset(d *C.dataset_t) C.int {
 	switch d.table {
-	case C.Data_data_jobs:
+	case C.XceData_data_jobs:
 		n := int(d.nrows)
 		if n == 0 {
 			return 0
@@ -243,7 +243,7 @@ func handleDataset(d *C.dataset_t) C.int {
 			gHandler.OnJobUpdated(info)
 		}
 
-	case C.Data_data_workers:
+	case C.XceData_data_workers:
 		n := int(d.nrows)
 		if n == 0 {
 			return 0
@@ -257,9 +257,9 @@ func handleDataset(d *C.dataset_t) C.int {
 			gHandler.OnHostUpdated(info)
 		}
 
-	case C.Data_data_jobArray:
+	case C.XceData_data_jobArray:
 		// job-array-single-wal-record task 5.4 (Req 6.2, 6.4, 6.5, 8.4):
-		// sibling receive path to the Data_data_jobs case above, for the
+		// sibling receive path to the XceData_data_jobs case above, for the
 		// compact array descriptor apiserver_push_jobarray() (apiserver.c,
 		// task 5.2) sends. Unlike the LIST-shaped cases, extract_data()
 		// (request.c, task 5.3b) always delivers exactly one descriptor

src/frontend/apiserver/backend/handler.go

@@ -97,13 +97,13 @@ func (h *DefaultHandler) OnResourceLocationUpdated(res *models.ResourceDistribut
 // dispatchJobArray delivers a locally-expanded compact array push to the
 // handler, one call per genuinely-new element (job-array-single-wal-record
 // task 5.4, Req 6.2, 6.4, 6.5, 8.4). CGO-free (called from handleDataset's
-// Data_data_jobArray case in clib.go; the elements themselves are already
+// XceData_data_jobArray case in clib.go; the elements themselves are already
 // decoded by cJobArrayToModels/rawJobArrayToModels before this is called),
 // mirroring dispatchConfigPush's split for testability without CGO.
 //
 // Dedup reuses store.Jobs itself — the SAME jobid-keyed store the ordinary
 // single-job push path already writes through (handleDataset's
-// Data_data_jobs case calls OnJobUpdated per job with no separate dedup
+// XceData_data_jobs case calls OnJobUpdated per job with no separate dedup
 // step, relying on the map being keyed by jobid) — checked here BEFORE
 // calling the handler so a redelivered push (e.g. after an apiserver
 // reconnect) can never clobber a jobid whose state has since moved on.

src/frontend/apiserver/backend/handler_test.go

@@ -365,7 +365,7 @@ func TestDispatchConfigPush_NilClusterIsSkipped(t *testing.T) {
 
 // --- job-array-single-wal-record task 5.4: dispatchJobArray ---
 //
-// dispatchJobArray is the sibling of the single-job Data_data_jobs push
+// dispatchJobArray is the sibling of the single-job XceData_data_jobs push
 // path (clib.go handleDataset, which calls gHandler.OnJobUpdated per job
 // with no separate dedup step because store.Jobs is a map keyed by jobid).
 // For the array path, dedup happens BEFORE calling the handler so a

src/frontend/apiserver/backend/wire_dispatch_support.go

@@ -75,7 +75,7 @@ func wireDispatchBuildPush(baseJobID, arraySize uint64) (unsafe.Pointer, error)
 	jobArray.submit = submit
 
 	data := (*C.xce_data_t)(C.calloc(1, C.size_t(unsafe.Sizeof(C.xce_data_t{}))))
-	data.table = C.Data_data_jobArray
+	data.table = C.XceData_data_jobArray
 	C.wire_test_data_set_job_array(data, jobArray)
 
 	var request C.xce_request_t
@@ -178,7 +178,7 @@ func wireDispatchDeliver(pktHandle unsafe.Pointer) (int, error) {
 
 	// go_push_handler already freed *ds (see above) -- only the payload
 	// xce_job_submit_t it pointed to still needs freeing: free_Dataset()
-	// never touches ->rows, and handleDataset()'s Data_data_jobArray case
+	// never touches ->rows, and handleDataset()'s XceData_data_jobArray case
 	// (clib.go) never nulls d.rows after use (every element is its own
 	// independent Go-native copy via cJobArrayToModels, mirroring the C
 	// scheduler side's sched_handle_dataset() jobArray case). Freeing it now