fix(integrity): forward-sync SQLite foreign-key diagnostics

[RecursiveIntell]

Scope and dependency

Forward-sync only the Libraries-owned, read-only SQLite foreign-key integrity diagnostic into the standalone semantic-memory mirror. This draft stacks on PR #3 (ccc08cd14fbd45eab22c4b6a3179ed501e5660f0), which itself stacks on #2. The changed paths are src/db.rs, src/lib.rs (diagnostic documentation only), and tests/foreign_key_integrity.rs (exact Libraries-main test blob). No whole-file mirror copy, migration, schema or dependency change, live repair, merge, or activation.

VerifyMode::Full now reports pragma_foreign_key_check structural coordinates when stored rows violate foreign keys. The tested fixtures show structural coordinates without echoing their selected private canary values, and the diagnostic does not repair rows; this is not a general confidentiality guarantee. Quick is not an FK certificate. A failed FK check returns a typed database error.

Evidence and limits

In a disposable paired root assembled from committed Libraries main c77273a808242c8159288ef5cf04a0a50ba6e808 and mirror PR #3 head, the transferred test first failed four of five cases against mirror base, then passed all five after the bounded implementation. cargo test --locked -q -p semantic-memory --all-targets passed (120 library passed, 3 ignored; integration targets also executed); formatting, all-targets check, strict Clippy, and cargo package --locked -p semantic-memory --allow-dirty (archive and verification) passed. The scratch lock delta was exactly the paired-root script's declared PolyKV dependency drop. A second disposable pair using the CI workflow's older pinned Libraries 0b099ec416de60f6adafb182f1d1e83795d05c56 passed the five tests, formatting, strict all-targets Clippy, and exact lock-delta check. Both local pairs used the same three candidate-file hashes. Hosted paired-root run 36427975471 completed success at PR head 2fb331cf9da5a54a20d99df04d4d6c87e733818a: it assembled the PR synthetic merge with pinned Libraries 0b099ec416de60f6adafb182f1d1e83795d05c56, checked the scratch lock delta, formatting, canary example, strict all-targets Clippy, and 120 library tests passed with three ignored. A second hosted paired-root run 36429404437 completed success at updated PR head 591f1cd0f6e18229780328df0c557213391d1901. In its pinned disposable pair it ran the new FK integration suite (5 passed) and cargo package --locked -p semantic-memory --allow-dirty (172 files archived, package verification compiled), in addition to the library lane (120 passed, 3 ignored). Cargo warned that the locked chacha20 v0.10.1 is yanked; this remains dependency debt. Neither hosted run establishes an independent standalone checkout or whole-mirror parity.

The standalone checkout itself fails Cargo metadata before compilation because blake3 inherits a workspace dependency without a workspace root. The paired-root proof does not make it a standalone release. A requested hostile_memory_integrity test target does not exist; the applicable authority suite requires --features testing and passed six tests. No Rust/Python claim-support conformance, full mirror parity, or release-readiness claim is made. The parent PRs remain unmerged. Rollback: close this draft or revert its two scoped commits; preserve the dirty physical Libraries checkout and all unrelated mirror paths.