feat(perf): compare frozen queries with Athena

[bill-ph]

Summary

Add Athena on-demand as a third protocol in the frozen performance scenario so Duckgres raw Parquet, DuckLake via Duckgres/Trino, and Athena external-table latency are measured over the same immutable files.

Depends on PostHog/posthog-cloud-infra#10231 being applied and its outputs being configured as the repository Athena secret and variables.

Changes

• add an AWS SDK Athena driver with result reuse disabled, full wall-time measurement, cancellation, pagination, output-root validation, and provider timing/scan metrics
• extend paired catalogs with an Athena external-table relation and route each relation only to protocols that can query it
• keep query_results.csv v1 unchanged and add query_service_metrics.csv for queue, planning, engine, scanned-byte, DPU, and engine-version data
• give the frozen scenario a dedicated ServiceAccount and create/delete its EKS Pod Identity association per run
• run one warmup and four measured Athena iterations alongside the existing Duckgres and Trino measurements
• document setup, defaults, validation, and recovery

Testing

• just test-unit (passes outside the sandbox)
• go test ./tests/mw-dev/scenario ./tests/mw-dev/scenario/perf ./tests/mw-dev ./tests/perf/...
• golangci-lint run ./tests/perf/... ./tests/mw-dev/scenario/... (zero issues)
• just lint was run; it reports six pre-existing SA4023 findings in main.go, cmd/duckgres-controlplane/main.go, and controlplane/control.go, outside this change

Rollout

Merge and apply the infrastructure PR first, configure MW_DEV_ATHENA_POD_IDENTITY_ROLE, MW_DEV_ATHENA_WORKGROUP, MW_DEV_ATHENA_DATABASE, and MW_DEV_ATHENA_RESULTS_S3_URI, then merge this PR and manually run posthog_frozen_perf.

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	3	19	0
E2E/journey files	0	0	0
Workflow files	0	1	0

Signals

• Test cases: +11 / -0
• Assertions: +74 / -7
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.