P5.1: vendor SQLite 3.53.2 + sx bindings

Subplan 02 Slice 2 foundation. vendor/sqlite/ holds the amalgamation
(provenance + upgrade notes in its README); make build compiles it into
build/vendor/libsqlite3.a (statically linked into dist via -L) and
build/vendor/jit/libsqlite3.dylib (dlopen'd by sx run via tests/run.sh's
-L flag) — separate directories because the macOS linker prefers a dylib
over an archive in one search dir.

The sx JIT resolves #foreign symbols via dlsym(RTLD_DEFAULT), where the
already-loaded OS libsqlite3 wins by load order — so the vendored build
renames its API to dist_sqlite3_* (vendor/sqlite/rename.h, -include'd),
making resolution unambiguous in both modes: those symbols exist only in
the vendored products.

src/db/sqlite.sx binds the renamed surface behind Sqlite/SqliteStmt
(open/exec/prepare/bind/step/column/finalize, errmsg, last_insert_rowid,
changes, libversion); opaque handles cross the FFI as usize, strings
read from sqlite are copied before its buffers die.

make test 20/20 (new: sqlite_smoke.sx — pins the loaded version to the
vendored 3.53.2, round trip, reopen persistence, BEGIN/ROLLBACK, errmsg;
also verified as an AOT binary with no libsqlite3 in otool -L).

vendor/sqlite/README.md

@@ -0,0 +1,21 @@
+# Vendored SQLite
+
+- Version: **3.53.2** (`SQLITE_VERSION` in `sqlite3.h`)
+- Source: <https://sqlite.org/2026/sqlite-amalgamation-3530200.zip>
+- Zip sha256: `8a310d0a16c7a90cacd4c884e70faa51c902afed2a89f63aaa0126ab83558a32`
+- Files kept: `sqlite3.c`, `sqlite3.h` (the amalgamation; `shell.c` and
+  `sqlite3ext.h` dropped — no shell, no loadable extensions)
+- License: public domain (<https://sqlite.org/copyright.html>)
+
+`make build` compiles this into `build/vendor/libsqlite3.a` (statically
+linked into the `dist` binary via `-L build/vendor`) and
+`build/vendor/jit/libsqlite3.dylib` (dlopen'd by `sx run`, which is how
+`make test` executes the test programs). The two locations are separate
+on purpose: the macOS linker prefers a dylib over an archive in the same
+search directory, and the AOT binary must link the static copy.
+`tests/sqlite_smoke.sx` asserts `sqlite3_libversion()` equals the version
+above, so a fallback to the OS libsqlite3 fails loudly in both modes.
+
+To upgrade: replace `sqlite3.c`/`sqlite3.h` with a newer amalgamation,
+update this file and the version constant in `tests/sqlite_smoke.sx`, and
+run `make clean test`.

vendor/sqlite/rename.h

@@ -0,0 +1,34 @@
+/*
+ * Symbol prefix for the vendored SQLite build.
+ *
+ * The sx JIT resolves #foreign symbols via dlsym(RTLD_DEFAULT), which
+ * searches every image already loaded into the process — and the OS
+ * libsqlite3 is usually among them, so the standard names would silently
+ * bind to the system copy instead of this vendored one. Prefixing the
+ * API surface makes resolution unambiguous in both JIT (dlopen) and AOT
+ * (static link) modes: dist_sqlite3_* exists ONLY in the vendored build.
+ *
+ * Only the functions bound in src/db/sqlite.sx are renamed; extend BOTH
+ * files together when new API is needed. Injected via `-include` in the
+ * Makefile's SQLITE_DEFS, so sqlite3.c and its embedded sqlite3.h see
+ * the renames consistently.
+ */
+#define sqlite3_open              dist_sqlite3_open
+#define sqlite3_close             dist_sqlite3_close
+#define sqlite3_exec              dist_sqlite3_exec
+#define sqlite3_prepare_v2        dist_sqlite3_prepare_v2
+#define sqlite3_step              dist_sqlite3_step
+#define sqlite3_finalize          dist_sqlite3_finalize
+#define sqlite3_reset             dist_sqlite3_reset
+#define sqlite3_bind_text         dist_sqlite3_bind_text
+#define sqlite3_bind_int64        dist_sqlite3_bind_int64
+#define sqlite3_bind_null         dist_sqlite3_bind_null
+#define sqlite3_column_int64      dist_sqlite3_column_int64
+#define sqlite3_column_text       dist_sqlite3_column_text
+#define sqlite3_column_bytes      dist_sqlite3_column_bytes
+#define sqlite3_column_type       dist_sqlite3_column_type
+#define sqlite3_column_count      dist_sqlite3_column_count
+#define sqlite3_errmsg            dist_sqlite3_errmsg
+#define sqlite3_libversion        dist_sqlite3_libversion
+#define sqlite3_last_insert_rowid dist_sqlite3_last_insert_rowid
+#define sqlite3_changes           dist_sqlite3_changes