Your app connects through PgBouncer in transaction pooling mode. Which of these behaves correctly?

"Running SET LOCAL statement_timeout = '5s' inside a BEGIN ... COMMIT block" is correct. SET LOCAL lasts only until the current transaction ends, and in transaction mode you keep the same connection for the whole transaction.

In transaction mode, PgBouncer gives a client a server connection for one transaction only. After that, another client may get the same connection. So anything tied to the session lands on a connection you no longer own, or leaks to other clients:
• "Running SET search_path = tenant_42 once after connecting": later queries may run on a different connection without this setting.
• "Taking a session-level pg_advisory_lock" in one request and releasing it later: the release may run on a different connection, so the lock is never freed.
• "Using LISTEN jobs": the notifications go to a connection that another client may now be using.