Contract ORM API and preserve migration scripts and failed cleanup

[smiggleworth]

Migration scripts currently stop after the first SQLite statement, while successful PostgreSQL scripts fail when their multiple results are read as one result. Failed rollback/unlock/deallocation can also return or leak an unsafe connection. This change adds the explicit optional adapter script boundary, quarantines failed SQLite connections (including retryable physical close), and discards poisoned PostgreSQL clients while preserving the primary operation error. Escaped transaction migration handles now reject plan/apply/resolve before SQL; CLI database entries load through file URLs for Windows paths and reserved URL characters.

The 0.5.0 API review cuts 132 entrypoint/name pairs to 78, removes sql.key, and makes the existing ORM-owned CLI implementation private behind the single runDatabaseCli bridge. All five export-map keys remain. The generated GeneratedDatabaseArtifact contract and askr-cli's metadata/dynamic bridge are retained; every removed name has a migration note. Of the 41 moved tooling function bodies, 40 remain token-identical; loadDatabases receives the intentional file-URL correction reproduced by the strengthened cross-platform generation fixture.

Validation:

• The final 33-case focused probe fails 14 cases against original adapter/migration/client/tooling source and passes 19 characterizations; the candidate passes all cases. A separate failed-close RED case refined quarantine cleanup before acceptance.
• Node 24.21.0 full gate with real PostgreSQL 18.6: 82 cases pass, including rollback/self-disconnect/lock recovery, complete scripts, wide binds, cursor cancellation and shared null/empty/binary/large-value parity with SQLite.
• Clean npm ci passed; the final full gate contains 70 ordinary cases and 12 PostgreSQL integration cases. Normal hosted CI gates Linux/macOS/Windows without a database URL and separately qualifies PostgreSQL 16/17/18. The initial Windows failure exposed the path loader bug above. Exact head ae0a5da passes all three platforms, PostgreSQL 16/17/18, the stable required package aggregate, and CodeQL (CI 37987685353; CodeQL 37987679086).
• Strict packed TypeScript 6/7 checks verify all 78 names, 54 removed imports, removed sql.key, 14 private paths, minimum normal PostgreSQL peer installs, root/SQLite optional-peer isolation and installed SQLite migration/rollback behavior. Lint, types, formatting, coverage, build, unchanged benchmark gate, publint and packing pass; compatible tooling audit is clean.

Remaining release blocker: the real PostgreSQL generation/validation workflow is incomplete in the existing shadow reset/introspection/description methods. It is reproduced and tracked in #55. The prior fake-driver generation test does not qualify that workflow. This PR does not declare the ORM ready, bump a version, tag or publish. #53/#54 stay open pending #55 and the complete candidate/website qualification.

Refs #53, #54, #55. Full maintainer review of the final coordinated 0.5.0 candidate is required before publication.