fix(sqlite): upgrade bundled SQLite and checked hooks

[forhappy]

Cellule currently bundles SQLite 3.49.1, which is affected by the upstream WAL-reset corruption race. Upgrade the ordinary published dependency to rusqlite 0.39 / SQLite 3.51.3 and preserve range-checked unsigned SQL bindings with fallible_uint.

This upgrades current Cellule 0.2 main. The matching minimal backport for Crab's pinned 0.1 revision is #78; Crab can consume that dependency correction without importing the unrelated Node Bundle migration. No merge requested.

Contract adaptation

• Replace removed DatabaseName::Main with upstream's MAIN_DB at incremental blob I/O and read-only-root validation.
• Propagate fallible hook installation before any application SQL. rusqlite 0.39 rejects hooks on borrowed handles; ignoring that result would execute SQL without the authorizer. Preserve standard typed error sources and scoped cleanup on every exit.
• Add a borrowed-handle regression at the public SQL-query boundary. Existing protected-table, trigger/view and post-error cleanup coverage remains.
• Keep managed capture, checkpoint and verified recovery policies unchanged. No patch override, vendored source or configuration surface.
• Lockfile changes are limited to rusqlite/libsqlite3-sys, its hashlink/hashbrown/foldhash closure, and wasm-target dependencies introduced by upstream. Native builds still link the bundled fixed SQLite.

Evidence and limits

• Read the upstream release, Cargo features and downloaded SQLite source. The linked amalgamation identifies SQLite 3.51.3 with source ID 737ae4a34738ffa0c3ff7f9bb18df914dd1cad163f28fd6b6e114a344fe6d618.
• The borrowed-authorizer regression fails before the adapter correction and passes afterward.
• All seven SQL integration tests pass, including real mutation, publication and exact restore. The complete 56-test primitive integration target also passes.
• LTX replica qualification passes 322 executable tests and one doctest, with seven opt-in cases ignored. The local-only feature separately passes 55 library tests, ten integration tests and its doctest. Strict LTX/runtime all-target/all-feature Clippy passes. Full workspace, cross-platform and provider qualification remain CI/live gates; this PR stays draft.
• Architecture boundaries, module ownership, 141 Rust documentation snippets and 1,496 local documentation links pass. A missing local PATH entry was corrected before rerunning these checks.

Review evidence map

Boundary	Evidence
Dependency owner	Workspace rusqlite shared by cellule-ltx and cellule-runtime
Callers	Managed DB capture/recovery; public sql_batch/sql_query_batch via execute_batch; incremental blob write
Callees	rusqlite MAIN_DB, checked hook registration and SQLite WAL/checkpoint implementation
Siblings	SQL read/write batches share AuthorizerGuard; existing primitive tests cover protected access and cleanup
Baseline	Current main aaacf31; only the dependency closure and required API adaptations change
Sibling dependency	Backport #78 carries the equivalent fix on Crab's exact pinned 0.1 lineage

Is this the best fix? Use the maintained upstream SQLite fix and adapt its explicit API contracts. Global cache serialization or private SQLite patches would add ownership complexity and constrain throughput without delivering the same dependency correction.

Primary contracts: SQLite WAL-reset fix, rusqlite 0.39 release, feature authority.