fix(sqlite): enforce row cap while stepping

[chaliy]

What

Enforce SqliteLimits::max_rows_per_query inside SqliteEngine::execute before cloning/materialising each returned row.

Also threads the same cap through sqlite dot-command queries, including .dump, and tightens TM-SQL-004 regression coverage.

Why

The previous sqlite row cap was checked only after execute returned, so oversized result sets could be fully materialised in memory before rejection.

How

• Pass the configured row cap into the engine step loop.
• Reject the first row beyond the cap before cloning row values into outcome.rows.
• Pass the row cap through dot-command dispatch helpers.
• Add direct SELECT and .dump row-cap tests, plus a stricter black-box TM-SQL-004 case.
• Update sqlite spec/threat-model text to document pre-materialisation enforcement.

Risk

• Low
• SQLite queries that exceed the configured row cap now fail earlier, before rendering or collecting the over-cap row.

Checklist

• Tests added or updated
• Backward compatibility considered

Verification:

• cargo fmt --check
• CARGO_BUILD_JOBS=2 CARGO_INCREMENTAL=0 cargo clippy -p bashkit --features sqlite --all-targets -- -D warnings
• CARGO_BUILD_JOBS=2 CARGO_INCREMENTAL=0 cargo test --features sqlite -p bashkit --lib row_cap -- --nocapture
• CARGO_BUILD_JOBS=2 CARGO_INCREMENTAL=0 cargo test --features sqlite -p bashkit --test sqlite_security_tests -- --nocapture
• CARGO_BUILD_JOBS=2 CARGO_INCREMENTAL=0 cargo test --features sqlite -p bashkit --lib
• CARGO_BUILD_JOBS=2 CARGO_INCREMENTAL=0 cargo test --all-features -p bashkit --lib
• CARGO_BUILD_JOBS=2 CARGO_INCREMENTAL=0 just pre-pr reached cargo test after fmt/clippy, then failed during integration-test linking with ld: write() failed, errno=28 (local disk full), not a test failure.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	b798ca8	Commit Preview URL	May 08 2026, 08:15 PM