ci,test: harden CI and close coverage gaps with fault-injection tests

[portlandhodl]

Summary

• Fault-injection tests close nearly every uncovered error path in both store backends. Line coverage is now 100% for sqlite.rs, 96.5% for postgres.rs, 96.3% for lib.rs (98.3% total); the residual lines are documented-unreachable branches or error mappings that require the connection dying mid-transaction.
  • Read path: drop each wallet table in turn, assert the read fails with QueryError carrying that query's table label.
  • Write path: eight scenarios persisting changesets that touch only the statement under test against a store whose target table is gone.
  • Block upsert INSERT / None-hash DELETE: injected with RAISE triggers, since they can only fail after an earlier statement on the same table succeeded.
  • The manual Clone impl: a cloned store shares the pool.
• Hardened CI workflow replacing rust.yml:
  • rustfmt, clippy (--all-targets -Dwarnings), docs (RUSTDOCFLAGS=-D warnings, private items included)
  • test matrix on stable and beta against postgres 14, all targets plus doctests
  • MSRV 1.88 job (verified locally; pinned via rust-version in Cargo.toml)
  • coverage gate: cargo llvm-cov --fail-under-lines 97, lcov uploaded as artifact
  • cargo-deny (advisories, licenses, bans, sources) — replaces rustsec/audit-check, which failed on every run because Cargo.lock is gitignored ("Unexpected end of JSON input"); deny needs no lockfile and covers the same RustSec advisories plus license/source gating via the new deny.toml
  • cross-platform cargo check on macOS and Windows
  • supply-chain hardening: all actions pinned to full commit SHAs, permissions: contents: read, per-job timeouts, PR concurrency cancellation, weekly cron so new advisories surface without a push
• Cargo.toml gains the license = "MIT" field cargo-deny flagged; the docs gate caught one broken intra-doc link in sqlite.rs.

Every gate was verified passing locally (fmt, clippy, docs, full suite on postgres 14 + sqlite, coverage, deny, MSRV 1.88 check) before being added to CI.

Note: job names changed, so any required status checks in branch protection will need re-selecting.

Test plan

• cargo test --all-targets + cargo test --doc against postgres 14 and sqlite — 58 + 2 + 2 pass
• cargo llvm-cov ≥ 97% lines (98.3% measured)
• cargo deny check, cargo fmt --check, cargo clippy --all-targets -- -Dwarnings, RUSTDOCFLAGS="-D warnings" cargo doc
• cargo +1.88 check --all-targets (MSRV)
• CI green on this PR