…rov fix

Step 4 partial. Lands the mechanical DDL-correctness work (V-L2-G1,
H1, H2, I1, J1, K1). The bigger architectural items in Step 4 stay
filed (V-L2-A1 sqlparser replacement, V-L2-B2 composite-id hashing,
V-L2-F1 dialect split) — each needs a dedicated session.

V-L2-G1 — identifier validation:
  Added `validate_identifier` / `must_validate_identifier` to
  overlay.rs accepting only `^[A-Za-z_][A-Za-z0-9_]*$`. Every
  user-controlled identifier flowing into `INSERT OR IGNORE INTO
  verisimdb_metadata VALUES ('{}', ...)` is now validated at
  codegen time, so a table named `posts'); DROP TABLE x;--` is
  rejected with a structured error instead of injected. Two new
  test sets cover 5 safe names and 10 attack strings.

V-L2-K1 — provenance latest-per-entity view fixed:
  The previous greatest-N-per-group subquery had a broken
  correlation (inner MAX subquery referenced the outer
  uncorrelated row rather than the alias). Replaced with the
  canonical ROW_NUMBER() OVER (PARTITION BY entity_id ORDER BY
  timestamp DESC) = 1 pattern, which works on SQLite 3.25+ and
  PostgreSQL. The integration test for the view now asserts the
  new pattern and the absence of the old broken correlation.

V-L2-H1 + V-L2-H2 — temporal exactness:
  - CREATE UNIQUE INDEX (was non-unique partial); enforces exactly
    one current row per (entity, table) at DB level instead of
    relying on application-layer discipline.
  - CHECK valid_to IS NULL OR valid_to >= valid_from.
  - CHECK version >= 1.

V-L2-I1 — lineage self-edges forbidden:
  CHECK NOT (source_entity = target_entity AND source_table =
  target_table). Cycle prevention beyond self-edges is V-L1-G1
  (runtime concern, separate ADR).

V-L2-J1 — closed-set CHECKs and the missing FK:
  - provenance_log.operation ∈ {insert,update,delete,transform}
  - lineage_graph.derivation_type ∈ {copy,transform,aggregate,join,filter}
  - temporal_versions.operation ∈ {insert,update,rollback}
  - access_policies.access_level ∈ {read,write,admin,deny}
  - access_policies.active ∈ {0,1}
  - simulation_branches.status ∈ {active,merged,abandoned}
  - simulation_deltas.operation ∈ {insert,update,delete}
  - simulation_branches.parent_branch REFERENCES
    simulation_branches.branch_id (self-FK; was declared but
    un-enforced).

DDL tests added for every constraint above (7 new test functions).

Verified locally:
- cargo fmt --all -- --check clean
- cargo clippy --all-targets -- -D warnings clean
- cargo test reports 49 lib + 9 integration = 58 tests, 0 failed
  (was 42 + 9 = 51; +7 codegen tests)

Closes #39, #40, #41, #42, #43

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>