feat(sdk): ms.DependencyDB — restricted cross-module read client (Milestone H Phase 3)

[I-am-nothing]

What

ms.DependencyDB — the consumer-side SDK client of the platform's read-exposed proxy (decision-17 §2, option (d)). A dev-plane consumer that declared ms.DependsOn("@owner/producer", n.Table("users")) can now read those exposed rows at runtime:

rows, err := ms.DependencyDB(ctx, "@owner/oauth-core").
    Select("users").
    Columns("id", "email").
    Where("status", "active").
    WhereIn("id", 1, 2, 3).
    Limit(500).
    Rows(ctx) // or .Result(ctx) for the Truncated flag

Structured reads only — logical table + projection + equality/IN filters. No raw SQL, no pool: the dev plane holds no socket to the platform DB, so a cross-plane SQL JOIN is structurally impossible — fetch the exposed rows, then join in application code. The platform authorizes against the consent+exposure catalog and executes as the consumer's own r_<app8>_<mod> role in a READ ONLY transaction.

How

• Transport: rides the existing module→dispatch seam (dispatchBase()/MS_DISPATCH_URL + the shared callHTTP client — the same seam ms.Call/ms.Emit/meter use; no second client config). Authenticates with the live tunnel session's MS_INTERNAL_SECRET as X-MS-Service-Secret.
• Typed fail-closed errors (match with errors.Is, never silently empty rows):
  • ErrDependencyUnauthorized — 401 (no/wrong tunnel session secret)
  • ErrNotExposed — 403 read_not_authorized (not exposed by the running version / no consent / no role — deliberately collapsed)
  • ErrDependencyUnavailable — 403 dependency_unavailable AND envelope-less 404/405 (proxy route absent)
  • ErrProducerNotFound — 404 producer_not_found
• Client-side validation mirrors the platform caps so oversized requests fail fast in-process: snake_case ^[a-z][a-z0-9_]{0,62}$ identifiers, ≤64 columns, ≤16 filters, 1..200 IN values, scalar-only filter values, one predicate per column, ≤64KB envelope. The builder latches the FIRST error so chains stay ergonomic.
• Producer refs accept the DependsOn spec forms (@owner/slug | slug | m<hex> | dashed UUID; trailing @constraint ignored — reads target the version the producer actually runs).
• Row numerics decode as json.Number for int64 join-key fidelity in the app-code join.
• Dev-plane only in this PR: a deployed consumer reads a co-located producer directly via mod.DB (GRANT SELECT); Lambda mode fails fast with an explicit error. Envelope-vended proxy credentials for deployed cross-plane reads are a documented follow-up.

Wire contract cross-verified against the actual dispatch handler (field names, header, status codes, {"error":{"code","message"}} envelope).

Testing

11 unit tests against an httptest fake dispatch: happy path (full wire-shape assertion + json.Number fidelity + Truncated), empty-rows-never-nil, every error mapping (401/403×2/404×2), 500-is-generic, producer-ref parsing, builder validation (12 cases, all pre-network), first-error-wins, missing app scope, missing tunnel secret, Lambda fail-fast, panic-before-Init. Full go test ./... green.

🤖 Generated with Claude Code