test: cover the capture-identity guard and IdentityConflict

Table-drives IdentityConflict (proof-only, empty-axis lenience, replica
system_identifier sharing) and the guard through runSnapshotTake: baseline,
match, foreign cluster, wrong db, --force bypass, and fail-closed on an
unreadable prior.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

feat: capture system identifier

test: cover session guards, the 25006 write refusal, and role preflight

Live tests (TEST_DATABASE_URL-gated) assert the compliance guarantees
directly: all four session GUCs are set, a write through the default
connection path fails with SQLSTATE 25006, InjectStats still writes
through a guarded connection, and RoleReport matches pg_roles. Pure
tests cover the privilege classification and the --allow-privileged
policy.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

fix: isolate each injection in a savepoint

chore: wired min_severity

Merge branch 'schema_version'

fix: missing file

Merge pull request #33 from boringSQL/feat/npx

feat: distribute dryrun via npm with prebuilt platform binaries

fix: restart the history with v3 file format