feat: implement PRAGMA synchronous (FULL/NORMAL/OFF) (#645)

[iheitlager]

Summary

• PRAGMA synchronous was silently ignored (src/vdbe/pragma.rs had no handling), so every commit unconditionally did the fsyncs matching only stock SQLite's FULL default, with no way to opt into NORMAL/OFF.

• Adds a full parser → AST → codegen → VDBE path, mirroring journal_mode's (pager: journal_mode=WAL switching #388) shape but bidirectional — the bare query form (PRAGMA synchronous, no =) is implemented too, unlike journal_mode's (still Unsupported).

• Pager::flush_locked/flush_wal_locked now gate their three commit-time fsyncs on the active SynchronousMode, per the policy table in ADR-0036:

  Level	Journal fsync (rollback)	Main-file fsync (rollback)	WAL frame fsync
  Full (default)	yes	yes	yes
  Normal	yes	no	no
  Off	no	no	no

• Architecture note: SynchronousMode lives in src/header.rs, not src/pager.rs (its otherwise natural home) — vdbe/pragma.rs needs to name it directly, and vdbe/ may never use crate::pager directly (spec 001-architecture Requirement 1, enforced by tests/unit/layer_isolation.rs). Same reason JournalMode already lives there.

• Incidental fix: repl.rs's generic (non-SELECT) statement path was silently discarding any result rows a program emitted — meaning PRAGMA integrity_check's output was already being dropped, pre-existing and unrelated to this ticket, but fixed alongside it since synchronous's query form needed the same row-printing to be testable via the CLI at all.

• MemoryVfs gained a sync_calls() counter (shared across clones/handles) so the new Pager fsync-gating tests can assert whether a commit actually fsynced — an in-memory backend has no other way to observe that.

Test plan

• cargo test — full suite passes (975 lib tests + all integration suites, 0 failures)
• cargo clippy --all-targets / cargo fmt --check — clean
• make check-grammar-drift — clean (grammar EBNF extended with synchronous carve-out, tagged V7)
• make assurance — no dead links introduced
• Pager unit tests assert exact fsync counts per level, both rollback-journal and WAL commit paths
• VDBE/codegen/parser unit tests for set + query forms, all three levels, case-insensitivity, unsupported values (ON/EXTRA/out-of-range ints — explicitly out of scope per the ticket)
• Oracle-parity CLI test (tests/unit/pragma_synchronous_repl.rs) diffs our repl output against real sqlite3 for PRAGMA synchronous = <level>; PRAGMA synchronous; across OFF/NORMAL/FULL

Refs: #645

spend: matched estimate (medium)

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com