Add safe subprocess helpers and the full --check-safety audit

[roachitect-aman]

EOF2
Task 3 of the MVP plan. Credentials now flow to psql and pg_dump through the
environment only, and --check-safety grew from a token scan into a real audit of
this file's own SQL and child-process usage.

Subprocess helpers

A single run_command() is the only subprocess.run in the file. That is the point:
one call site is what makes the credential handling reviewable at a glance, and
--check-safety now enforces it mechanically.

safe_env() starts from our own environment, so an operator's PGSSLMODE and
PGSSLROOTCERT keep working, drops every DBPROFILER_* variable so no child ever
sees the raw URL or the token key, overlays the parsed connection settings, and pins
LC_ALL=C so error text does not depend on the operator's locale.

On top of it: run_psql, run_psql_scalar, run_pg_dump, and
probe_server_version — which finally gives the version gate from task 2 a caller.

Redaction

redact_error() scrubs connection URLs, password= / PGPASSWORD= assignments, and
libpq env values (longest first) out of child stderr before it is surfaced. Assume
every error path is printed.

PGPASSWORD is replaced however short. Other libpq values are replaced only at
length >= 4, because blind-replacing a two-character PGUSER shreds unrelated words
and destroys the diagnostic. PGPORT is never replaced — a bare port number matches
far too much text. There is a test for each of those three behaviours.

--check-safety now audits the source, not just the SQL

It parses this file with ast rather than grepping it, and requires exactly one
subprocess call site, an explicit env= on it, no shell=, and no credentialed
connection URL in any string literal. A bare postgres://... placeholder in a
docstring stays legal; one with an @ does not.

Deviations from the plan

The allowlist has no pg_catalog wildcard. The plan called for one. It should
not have: pg_catalog is not a safety boundary. It holds role password hashes
(pg_authid, pg_shadow), actual user data (pg_largeobject), raw statistic values
without the per-permission filtering the pg_stats view applies (pg_statistic),
and two relations whose option fields carry passwords (pg_subscription,
pg_user_mapping). Relations are now enumerated one by one, with a
DENIED_RELATIONS map recording a reason per trap, and a schema qualifier other than
pg_catalog is itself a violation — so evil.pg_class is rejected even though
pg_class is allowed. Set-returning functions get their own small allowlist, so
FROM unnest(...) passes and FROM pg_read_file(...) does not.

Dropped -A and -F, from the psql arguments. --csv is its own output format,
and -A placed after it overrides it. Keeping both would have made the parse
order-dependent.

Added -w to both commands, and ON_ERROR_STOP=1. Without -w a missing
password blocks the child on a terminal read, and the run fails by timeout instead of
immediately. ON_ERROR_STOP turns a SQL error into a nonzero exit rather than a
silently empty result set.

pg_inherits is deliberately still absent. Task 5 reads it, and the house rule is
that a relation is allowlisted in the same change as its collector.

Verification

• 92 tests pass (45 new).
• python3 dbprofiler.py --check-safety exits 0.
• ruff check clean. S608 added to the test per-file ignores: the safety tests
  plant deliberately unsafe SQL to prove the guard rejects it.
• Source re-verified as 3.9-parseable.
• Adversarially probed: planting a second, shell-using call site into the real source
  produces all three expected violations.