typelayer: the process image zone depends on which tenant binds first #726

Found while moving the type layer to chtypes 1.0 in draft PR #712 (branch chtypes-v2).

Problem. A process has one chtypes image zone. It is fixed for the life of the process, and it decides how zone-less DateTime columns and the functions over them are computed. WaveHouse takes it from the first tenant that is actually served: the tenant's zone name is recognised, an artifact is installed for its ClickHouse line, and its first open succeeds. When tenants' servers run in different time zones, which tenant that is depends on which tenant's discovery finishes first. That is a race between discovery loops, so it can change from one restart to the next.

Effect.

• A tenant whose server zone differs from the image zone has its own zone passed per call, so literal comparisons and input parsing still match its server.
• But a table with a zone-less DateTime/DateTime64 column plus any DEFAULT/MATERIALIZED/ALIAS/EPHEMERAL expression is unavailable for that tenant. Column functions run in the image zone (upstream: Per-schema server profile: the server's zone and input-affecting settings, honoured by functions, DEFAULTs, literals and parsing (1.0.x, high priority) chtypes#419).
• So in a multi-zone deployment, which tenants' tables are unavailable can differ between restarts with no configuration change.
• On chtypes Go SDK v1.0.1, a first open that fails after setup also latches that zone until restart (Known 1.0 limitation: setup latches an image zone the library does not know; the process cannot recover without a restart chtypes#458). Other-zone tenants are then refused whole, until a tenant in that zone is served or the process restarts.

Evidence.

• Inferred from internal/typelayer/zone.go (openLine/openFirst) and internal/app discovery wiring on the PR branch.
• The image-zone subprocess tests in internal/typelayer/zone_test.go pin the first-served rule. They cover a Tokyo tenant first, a missing artifact first, an unrecognised zone first, a failed first open, and concurrent first binds. The concurrent case shows exactly one commit, but not which tenant wins.
• Not reproduced end to end against two ClickHouse servers in different zones.

Who meets it. Only processes whose tenants' servers report different time zones. A deployment whose tenants share one zone always gets that zone.

Related: #717 (zone-name spelling).