Fail closed on SQLite snapshot sidecars

[lukisch]

What changed

• force backup snapshots into SQLite DELETE journal mode before redaction, scanning, verification, hashing, and publication
• detect and remove the complete adjacent SQLite artifact family, including unknown future sidecar suffixes
• clean snapshot, sidecar, manifest, and atomic manifest-temp artifacts on backup, scanner, quick-check, and manifest failures
• add SyncConfig.from_bytes(payload, source_path=...); from_file() delegates to it so callers can hash and parse the exact same bytes without parallel config semantics
• document the closed-snapshot invariant and exact-byte config API

Root cause

SQLite's backup API preserves the source database's persistent WAL journal mode. Later operations on the temporary backup could therefore create .partial-wal and .partial-shm files. The old cleanup removed only the main .partial file, so sidecars survived both successful publication and error paths.

Impact

A pushed transit now contains exactly one closed snapshot plus its manifest. Unmanifested SQLite sidecars fail closed and are removed. WAL source data remains included through SQLite's online backup API; no live database files are copied.

Validation

• python -m unittest discover -s tests -v — 26 passed
• python -m pytest -q — 26 passed
• python -m ruff check sqlite_transit_sync tests — passed
• python -m compileall -q sqlite_transit_sync tests — passed
• python -m sqlite_transit_sync --help — passed
• git diff --check — passed

Regression coverage includes WAL-backed success, credential-scanner failure, forced quick-check failure, manifest plus manifest-temp failure, backup failure, and an unknown future sidecar suffix. All tests use synthetic temporary databases; no live data is involved.