Antalya 26.3: mkmk-1: combined port of 2 PRs

[zvonand]

This PR needs manual intervention.
Cherry-pick of #1597 could not be resolved automatically (AI resolver was disabled, exhausted its iteration budget, or gave up).
The branch contains the first 1 commit(s) of the group; 0 later PR(s) were not attempted.
Conflicted files at the failure point:

• src/Storages/ObjectStorage/StorageObjectStorageSource.cpp
  Resolve the conflict locally, push the fix, and mark this PR ready for review.

Changelog category (leave one):

• CI Fix or Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Fix exception "Logical error: prewhere_info" when querying URL/S3 Parquet tables with a row-level security policy and no PREWHERE clause (ClickHouse#100361 by @alexey-milovidov, #1597 by @mkmkme).

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All with Aarch64
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

Combined port of 2 PR(s) (group mkmk-1). Cherry-picked from ClickHouse#100361, #1597.

• Fix exception in updateFormatPrewhereInfo when only row-level filter is set ClickHouse/ClickHouse#100361 — Fix exception in updateFormatPrewhereInfo when only row-level filter is set
• Antalya-26.1: Fix row policies silently ignored on Iceberg tables with PREWHERE enabled #1597 — Antalya-26.1: Fix row policies silently ignored on Iceberg tables with PREWHERE enabled

---

ClickHouse#100361: Fix exception in updateFormatPrewhereInfo when only row-level filter is set

updateFormatPrewhereInfo asserted that prewhere_info was non-null, but callers in StorageObjectStorage and StorageURL invoke it when either prewhere_info or row_level_filter is set. When a row policy exists on a URL/S3 table with Parquet format (which supports PREWHERE) and the query has no PREWHERE clause, only row_level_filter is populated — triggering the assertion.

Additionally, row_level_filter was never stored into the new ReadFromFormatInfo, so it would be silently lost.

Fix: relax the assertion to accept either being set, and store row_level_filter in the output.

Found in: https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=99537&sha=e2a32dfbb945f62e07bd3f66c206a71b584b96b1&name_0=PR&name_1=Stress%20test%20%28amd_debug%29
ClickHouse#99537

Documentation entry for user-facing changes

• Documentation is written (mandatory for new features)

---

#1597: Antalya-26.1: Fix row policies silently ignored on Iceberg tables with PREWHERE enabled

The Iceberg read optimization (allow_experimental_iceberg_read_optimization) identifies constant columns from Iceberg metadata and removes them from the read request. When all requested columns become constant, it sets need_only_count = true, which tells the Parquet reader to skip all initialization — including preparePrewhere — and just return the raw row count from file metadata.

This completely bypasses row_level_filter (row policies) and prewhere_info, returning unfiltered row counts. The InterpreterSelectQuery relies on the storage to apply these filters when supportsPrewhere is true and does not add a fallback FilterStep to the query plan, so the filter is silently lost.

The fix prevents need_only_count from being set when an active row_level_filter or prewhere_info exists in the format filter info.

Fixes #1595

Documentation entry for user-facing changes

...

[github-actions]

Workflow [PR], commit [f036393]

[mkmkme]

I'll have a look at it tomorrow, too busy today