fix(persistence): fail closed on Unicode-escaped SET parameter identity

[seonghobae]

Finding

#585 bounds PostgreSQL U&"..." identity for pg_settings UPDATE, but the direct SET path still matches only a normalized token equal to session_replication_role. The shared lexer currently preserves the U& prefix separately and projects the following quoted identifier. PostgreSQL's grammar accepts generic SET parameter names through var_name: ColId, and Unicode-escaped quoted identifiers are converted to ordinary identifier tokens before grammar reduction. Therefore a committed statement such as:

SET U&"session_replication_role" = replica;

or a code-point spelling such as:

SET U&"session_replication_\0072ole" TO replica;

resolves to the protected configuration parameter in PostgreSQL but can miss TEPP's direct-SET execution-context guard. That can suppress ordinary/default triggers while historical append-only/retention trigger definitions remain present.

Primary PostgreSQL 18 authority:

• Unicode-escaped quoted identifiers (U&"...", code-point escapes, optional UESCAPE) are PostgreSQL identifier syntax: https://www.postgresql.org/docs/18/sql-syntax-lexical.html
• PostgreSQL parser grammar reduces generic SET names through var_name: ColId and Unicode identifiers are decoded to identifier tokens by the raw parser (src/backend/parser/gram.y, src/backend/parser/parser.c, REL_18_STABLE).
• session_replication_role=replica suppresses ordinary/default triggers and rules: https://www.postgresql.org/docs/18/runtime-config-client.html#GUC-SESSION-REPLICATION-ROLE

Required contract

At exported validate_migration_catalog():

• committed SET U&"session_replication_role" = replica fails the runtime-role contract;
• equivalent code-point and explicit UESCAPE spellings fail closed;
• SET LOCAL / SET SESSION variants cross the same boundary;
• direct origin / local remain statically safe only when protected parameter identity is established;
• unrelated Unicode-escaped parameter names remain unrelated when the shared projection proves they are unrelated;
• rollback remains non-durable through the existing committed-state projection;
• comments, string literals, and dollar-quoted bodies remain inert;
• do not add a second raw-SQL lexer or weaken fix(persistence): fail closed on Unicode-escaped identifiers until lexical identity is decoded #585. The shared Unicode decoder remains the architectural endpoint; a bounded direct-SET fail-closed bridge is acceptable only while that decoder is absent.

Repair boundary

Reuse the single lexical pass and the committed execution-context fold. Do not rewrite executable migration SQL. Prefer one helper that resolves the direct SET parameter span consistently with #585's interim Unicode handling and leaves non-SET structural consumers untouched.

Keep open until post-#538 non-force-restack exact-head hosted Rust/Live PostgreSQL, current-topology rustdoc/coverage/security, resolved valid findings, and qualifying independent approval exist. Draft-skipped execution is not GREEN.

[seonghobae]

Ordinary-forward lineage started on #521:

• aa451a64b529be33a917ef7f32d05d82bca22764 — public RED adds exported validate_migration_catalog() coverage for canonical U&"session_replication_role", code-point escape, explicit UESCAPE, SET SESSION/SET LOCAL, safe origin/local, unrelated Unicode parameter, rollback, and opaque-region controls.
• 7f7a8d83ec8d6a6c4404ccbb49aef91006a89ce4 — bounded causal repair in migration_validation.rs. The direct-SET fold now consumes the shared lexer's U& + projected-identifier representation, treats INVALID_QUOTED_IDENTIFIER as potentially protected for a replica value, skips optional UESCAPE, and preserves safely projected unrelated identifiers. No second raw-SQL lexer or executable migration rewrite was added.

The architectural endpoint remains #585's shared PostgreSQL Unicode identifier decoder. Keep #586 open until post-foundation/restack hosted Rust/Live PostgreSQL, current-topology rustdoc/coverage/security, valid-review resolution, and qualifying independent approval exist.