fix(storage): bound SQL bridge reads and handles

[ohdearquant]

AI-assisted contribution: Codex prepared this change and PR description.

Summary

• make query_row stop after converting the first matching SQLite row and add an object-safe SqlReader::query_page(statement, PageRequest) compatibility method with bounded SQLite overrides
• cap caller-held file-backed SQL bridge handles per pool at the effective reader count and one writer, using the existing finite checkout timeout across every bridge sharing that pool
• keep each standalone connection and its permit as one cancellation-safe resource so detached blocking work cannot escape the live-handle cap
• add conversion-count, pagination, shared-cap, timeout, cancellation, writer-task, rollback, and object-safety regressions; document the compatibility and resource contracts

Closes #1442.

Test plan

• cargo test --manifest-path crates/Cargo.toml --workspace
• cargo check --manifest-path crates/Cargo.toml --workspace
• cargo clippy --manifest-path crates/Cargo.toml --workspace --all-targets -- -D warnings
• cargo fmt --manifest-path crates/Cargo.toml --all -- --check
• RUSTDOCFLAGS=-Dwarnings cargo doc --manifest-path crates/Cargo.toml --workspace --no-deps

All five gates passed against reviewed SHA 764772e6d8f8c1953c973386618ea994ffff5972 on unchanged main base a152ead3e577b8c01b03024687fdb66d94a00cac before this draft was opened.

ADR

• amend ADR-005 with the additive paging contract, first-row conversion guarantee, shared file-backed handle budgets, timeout behavior, and cancellation lifetime

AI-assisted contribution checklist

• Every claim in this PR description matches the actual diff
• Any agent-authored comment / PR body starts with an attribution line
• The public trait addition has a compatibility default and remains object-safe
• Existing full-result, transaction, writer-task, and in-memory semantics remain covered

Out of scope

• imposing an implicit ceiling on compatibility query_all
• rewriting caller SQL with LIMIT or OFFSET
• counting the writer task's fixed connection or store-internal operation-scoped connections as caller-held bridge handles