fix: harden SQL literal boundaries

[smiggleworth]

Summary

• make named-parameter rewriting reuse the quote/comment/dollar-quote-aware structural SQL scanner
• reject non-finite JavaScript numbers before emitting SQL literal text
• protect the bug class with a deterministic 100-sample scanner guardrail
• preserve the existing PostgreSQL/SQLite positional-placeholder behavior

Linked issues

Closes #12
Closes #13

Acceptance audit

• Every acceptance criterion in compileKeyedSql corrupts string literals containing :name-shaped text #12 is checked with evidence.
• Every acceptance criterion in literal() emits invalid SQL for non-finite numbers (NaN/Infinity) #13 is checked with evidence.
• Both issues include and satisfy a permanent class-level guardrail.

TDD evidence

Red commit: 58a63a8
Green commit: 162d242
Exact-reproduction commit: 53b6eff

Verification

• Focused SQL and adapter suites: 15 passed
• Full coverage suite: 39 passed, 4 local integration tests skipped without external PostgreSQL
• Type contracts and build
• Runtime benchmark gate
• Publint and dry-run package inspection
• Exact-head hosted package gate
• PostgreSQL 16, 17, and 18 integration jobs
• Squash merge dbe26746a542c305dd0b123b95c0e681e7be4772
• Annotated v0.0.1 tag dereferences to the squash merge
• First public release bootstrapped after the initial trusted-publishing run exposed the expected first-package authentication gap
• @askrjs/orm@0.0.1 is public and latest on npm with integrity sha512-9pNrEA0bQmQMBHJf1UanyNiObl1KvKxb/XkihPI2OZasGbnlZHWnFLoVVGS8qQ8knfvCtgOBMQGXNraTPvmMgA==
• Clean registry-only consumer installed CLI 0.0.23 and ORM 0.0.1, generated an SQLite database artifact, and passed askr database validate
• npm OIDC trusted publisher restricted to askrjs/askr-orm .github/workflows/publish.yml with npm publish permission

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.