Make failed statements atomic and harden recovery boundaries

[zvndev]

Summary

Make failed data mutations atomic across text, SQL, parameterized, prepared, and native/client entry points. Explicit transactions abort on statement errors; uncertain commits and poisoned handles return safe recovery guidance. Also harden view failure handling, correlated field binding, TLS dependencies, and benchmark/test reliability.

Type of change

• Bug fix
• Documentation
• CI / tooling
• Performance improvement

Behavior change

• Breaking: after an explicit-transaction error, applications must ROLLBACK before further work or COMMIT.
• Breaking: new Rust QueryError variants affect exhaustive matches.
• Ambiguous correlated bare fields are rejected; explicit outer aliases are supported. SQL subquery support is not expanded.
• Commit uncertainty never implies rollback or invites automatic retry. Poisoned engine locks use Internal wire errors with fixed safe guidance.
• Implicit transactions carry buffered BEGIN markers so pre-commit crashes cannot be mistaken for legacy boundary-free logs. No extra per-point fsync is introduced.
• Existing disk formats and numeric wire classes are unchanged. DDL is not newly transactional.

Test plan

• Final frozen Linux arm64 workspace with powdb-query/testing: 2,682 passed, zero failed, 202 targets. Four pre-existing ignored tests plus one ignored child fixture explicitly invoked by its parent crash test.
• Default-feature workspace run: all runtime suites passed except two stale oracle source anchors; anchors corrected and oracle passed in final workspace run.
• Strict all-target Clippy, rustfmt, warnings-as-errors rustdoc, missing-docs ratchet, version/CI-needs/testing-feature guards.
• Process-kill recovery before/after commit in Full and Normal; all-mode live rollback; fsync failure/uncertain-commit tests; view refusal and registry publication-failure tests.
• Fresh TS client suites and all 60 fresh Node-addon tests; packed npm import and Rust package-manifest smoke.
• Refreshed root/fuzz audits: zero vulnerabilities; seven existing root advisory warnings. cargo-deny and redacted gitleaks passed.
• All 23 Criterion workloads pass execution smoke; corrected wide comparison and durable-write/fsync smoke executed.
• Documentation and CHANGELOG updated.
• GitHub two-OS/sanitizer/Miri/compatibility release gates: pending CI.
• Authoritative Depot performance comparison: not completed locally; comparator correctly refuses ARM laptop vs x86 baseline.

Performance disposition and limits

This is a correctness/security update, not a speedup claim. Local same-harness control/candidate/control diagnostics show materially slower WAL-Off writes with rollback protection; reads are broadly comparable. Runs overlapped other verification and are not publication-quality timing evidence. The bounded safety tradeoff was independently reviewed and is documented in CHANGELOG; no thresholds or baselines were changed. Full remains default and point-write fsync counts remain unchanged.

Process-kill tests do not model power loss. View protections do not claim a complete cross-file DDL crash journal. No automatic data repair, version bump, merge, or release publication is included.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}