control-plane: default new tenants to aws-us-east-1-c2

[jwhartley]

Points new signups at the new public plane ops/dp/public/aws-us-east-1-c2 instead of aws-us-east-1-c1. Agreed in this thread. The plane itself is sized by estuary/est-dry-dock#354.

Draft until c2 finishes converging and is verified healthy. Do not merge before then, since it would send new tenants to a plane that is not yet serving.

What changed

One string literal in provision_tenant, plus the regenerated sqlx cache entry.

Why this is the thing to change

The default plane is not a column or a config value, which surprised me. It works like this:

1. provision_tenant collects every ops/dp/public/ plane and writes the names into the new tenant's storage mapping as an ordered list. The order by pins one name to the front.
2. When a publication does not name a plane, validation takes the first entry of that list (crates/validation/src/lib.rs, "Default to using the first data-plane attached to the storage mapping").

So whichever name is pinned to the front of that sort is the default for every new tenant, and changing it needs a code change and a deploy.

Worth flagging for anyone who assumed otherwise: setting closed = true on c1 does not do this. The query filters on the ops/dp/public/ prefix and two hardcoded exclusions, and never reads the closed column. Closing c1 hides it from the console listing and the signup picker, but new tenants would still be provisioned onto it. That column is a UI filter, not an assignment rule.

Blast radius

New tenants only. Existing tenants keep the list they were provisioned with, and existing tasks stay pinned to their own data_plane_id, so nothing migrates. Moving an existing tenant is a separate operation: reorder the array via updateStorageMapping.

c1 stays in the list for new tenants, just no longer first, so it remains selectable.

Verification

SQLX_OFFLINE=1 cargo check -p control-plane-api passes. That is the real check on the cache entry, since offline compilation fails on a missing query hash.

The sqlx cache filename is sha256(query_text), so editing the SQL orphans the old entry. This change only edits a string literal inside the query, so the describe block (columns, parameters, nullability) is unchanged and the entry was regenerated exactly, byte-identical in formatting to its neighbours. Git records it as a 96% rename.

No test depends on the ordering: fixtures/data_planes.sql contains no aws-us-east-1-c1 or c2 row, so tests fall through to the id desc tiebreak either way.

Follow-ups, not in this PR

• Set closed = true on c1 to hide it from the signup picker. Manual SQL, there is no mutation for it.
• discovers.data_plane_name still defaults to ops/dp/public/gcp-us-central1-c1, a plane this very query excludes as deprecated. Looks stale, left alone as unrelated.