Function is_cloud_env 

fn is_cloud_env(snapshot: &[(StateUpdateKindJson, Timestamp, Diff)]) -> bool

Detects whether the snapshot belongs to a Materialize Cloud environment. Extends the original v80_to_v81 heuristic to recognize the additional shape we missed back then:

• mz_system is Managed with a non-zero replication factor (the classic cloud shape; self-managed envs run it at 0 to save resources), OR
• mz_system is Unmanaged and has at least one ClusterReplica row pointing at it (cloud envs configured outside the managed variant still have at least one mz_system replica; self-managed sometimes has zero replicas at all).

In both cases, the enable_password_auth system parameter must not be on — only self-managed envs enable it, so that’s the deciding tie-breaker for any env whose mz_system shape would otherwise look cloud-ish.

Returns false on any error path (missing mz_system, failed parse), which is the safe default — a false negative means we leave auto_provision_source at None for a cloud env’s roles, which is no worse than the v80->v81 bug we’re already fixing.