Description

The membership reconciliation ensures the prebuilds system user is a member of all organizations with prebuilds configured. To support prebuilds quota management, each organization must have a prebuilds group that the system user belongs to.

Problem

Previously, membership reconciliation iterated over all presets to check and update membership status. This meant database queries GetGroupByOrgAndName and InsertGroupMember were executed for each preset. Since presets are unique combinations of (organization, template, template version, preset), this resulted in several redundant checks for the same organization.

In dogfood, InsertGroupMember was called thousands of times per day, even though memberships were already configured (internal Grafana dashboard link)

Solution

This PR introduces GetOrganizationsWithPrebuildStatus, a single query that returns:

• All unique organizations with prebuilds configured
• Whether the prebuilds user is a member of each organization
• Whether the prebuilds group exists in each organization
• Whether the prebuilds user is in the prebuilds group

The membership reconciliation logic now:

• Fetches status for all organizations in one query
• Only performs inserts for organizations missing required memberships or groups
• Safely handles concurrent operations via unique constraint violations
• This reduces database load from O(presets) to O(organizations) per reconciliation loop, with a single read query when everything is configured.

Changes

• Add GetOrganizationsWithPrebuildStatus SQL query
• Update membership.ReconcileAll to use organization-based reconciliation instead of preset-based
• Update tests to reflect new behavior

Related to internal thread: https://codercom.slack.com/archives/C07GRNNRW03/p1760535570381369