Confine SQL execution to registered snapshots and correct its security contract

[ancongui]

Generated, rewritten and direct SQL could read unregistered local files or URLs, and the direct SQL handlers did not consult registered table metadata before admission. This change confines execution to supplied registered snapshots and applies the same admission policy to initial SQL, Critic rewrites, and synchronous/SSE direct SQL.

• Admit reviewed pure function names and registered physical table references, including correctly resolved CTE aliases and correlated EXISTS. Missing dataset mappings fail closed.
• Independently validate SQL and snapshot mappings in DuckDBExecutor. Set exact allowed paths before disabling external access, disable automatic extension installation/loading, and lock configuration. Quote bootstrap identifiers/paths and preserve DERIVED snapshots through copy-on-write.
• Require DuckDB >=1.3.2: the previously declared 1.1.3 cannot initialize these file controls.
• Correct architecture, API, security and operational documentation to match the actual implementation. Query DTOs do not expose per-request row-cap or timeout fields. TableResolver constructs snapshot paths; it does not stage remote objects.

Validation: 386 unit tests passed with zero failures/errors/skips at both DuckDB 1.3.2 and 1.5.6. The root freshly reran 386 after integration onto canonical main. Independent native review passed 30 adversarial probes plus the derived-map mismatch check, including parser-omission tests, zero loopback HTTP requests, locked configuration and unchanged original snapshot bytes. Ruff and format passed; configured Pyright has 0 errors and 9 existing semantic warnings. All 21 lockstep files match pins. Documentation checks verified 237 local links,20 canonical boundary links, DTO examples and excerpt syntax; the resolver follow-up changes only docstrings with an identical executable AST.

Scope: registered local Parquet queries. Actor/token/workspace authorization and PostgreSQL RLS remain upstream; controlled direct-handler metadata tests do not establish RLS acceptance. Effective statement timeout, remote object-store query staging and an operating-system SQL sandbox remain separate work. Framework identity, canonical source URLs, existing SDK contracts and the pinned native MinIO prerequisite are preserved. No paid providers or cloud deployment were used.