fix(mysql): keep introspection SQL structurally static

[seonghobae]

Security outcome

MySQL/MariaDB metadata introspection keeps all four information_schema statements structurally static. The optional schema selector and the excluded system schemas cross the DB-API boundary only as %s parameters; no runtime SQL fragment interpolation or # nosec B608 suppression is required.

RED → GREEN lineage

• RED 40aae6f001615b8ee1199f592c5504eb5215984f: a recording DB-API boundary proves a hostile schema value occurs in parameters, never SQL text; the connection closes; production source contains no B608 suppression.
• GREEN 67ae24076ef9a071e50d127079d408ba0b01f8e5: four fixed metadata statements plus parameter-only schema selection.
• Scope repair a5d7704d81f6ce7edcec28024d912db8852ef8a3: unrelated schema-validation/lockfile delta removed.
• Regression finding 8146cb6cd8b5ba26c5f9103facc0808efbce17c5: a later descendant reintroduced WHERE {where} f-string construction with # nosec B608 on all four queries and deleted the focused recording-boundary regression. This was treated as a repair finding, not as a race or a reason to close the PR.
• GREEN repair 730bc0965c633c2e1cc8491c6098265446a68f2b: restore the static-SQL implementation from the verified semantic predecessor without rewriting history.
• GREEN test repair 8cf45febfb27ab35856f8fa0666ecedd7ab726ff: restore the hostile-schema parameterization and no-suppression regression test.
• Baseline fed6e6a04a0dbd5293c2b3a5d48af72d903206f5: record the current SQL/DB-API contract, exact repair lineage, required gate boundary, and the remaining real MySQL/MariaDB integration-fixture Gap in docs/product-technical-gap-baseline.md.

Exact current authority

• protected target: main@8dc746920c12988f082e914879d95e13c9693535
• exact head: fed6e6a04a0dbd5293c2b3a5d48af72d903206f5
• state: Draft

The two older Devin threads concerned unrelated control-character work that was removed from this PR; their concern remains outside this SQL-boundary delta rather than being waived here.

Merge boundary

Keep Draft until the unchanged exact head has terminal-success backend, frontend, strix, opencode-review, coverage-evidence, dependency-review, trivy-fs, osv-scan, scorecard, plus current review/thread evidence. Do not reintroduce dynamic SQL fragments, scanner suppressions, source-neutral retriggers, force history, self-approval, or gate weakening.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.