[Bug] HStore ordered scans fail when the Gremlin sandbox denies worker creation

[contrueCT]

Problem

HStore ordered scans can fail during Gremlin evaluation with:

SecurityException: Not allowed to access thread group via Gremlin

This was reported for six paged range-index queries while validating #2994. See the original report. The worker-creation problem is tracked separately from that PR's LABEL-query changes.

Cause and reproduction

OrderedKvIterator initializes multiple scan sources through a bounded executor whose workers are created lazily and can expire while idle. If submission requires a new worker during Gremlin evaluation, HugeSecurityManager denies thread-group access. Warming the executor at startup does not cover later worker expiry.

The failure was reproduced after syncing #2994 with master 1a15e762 (merge head bcb8c1f3), using the real GremlinGroovyScriptEngine.eval(), security manager, and production ordered iterator with controlled scan-source iterators. This is an isolated reproduction, not a rerun of the complete distributed HTTP query matrix.

Expected behavior: ordered scans complete without granting scripts thread-creation privileges, retaining ordering, limits, cursor behavior, and source cleanup.

Fix and verification

Fix PR: #3213, based directly on master. It initializes remaining sources on the caller when worker submission is denied, drains already-submitted tasks, and preserves the sandbox policy. Its description contains the flow diagram and exact test commands.

• Add regression coverage for denied worker creation and worker expiry, including direct script-thread creation remaining denied.
• Cover ordering, source failures, interruption, and cleanup when cancellation is also denied.
• Pass 15 security tests, 20 unique iterator tests, formatting, and all-module clean compilation on Java 11.
• Merge fix(hstore): preserve ordered scans under the Gremlin sandbox #3213, then sync fix(server): clarify condition resolution semantics for label queries #2994 with master again.
• Rerun the six reported paged range-index queries and the HStore/RocksDB validation matrix after integration.

The targeted test results do not establish complete PD + three-store HTTP matrix acceptance or CI success.

Visual summary