Keep governed commits and projections atomic

[aanishs]

Summary

• require governance commits to use an injected commit writer instead of bypassing projected writes
• add a SQL-on-FHIR governance adapter that atomically maintains canonical FHIR, history, input, ViewDefinition, reference, and search projections
• make stale search rows disappear when a resource is re-indexed with no searchable content
• route the governance HTTP handler and demo through the projected writer
• add rollback coverage for projection failure after intermediate rows have been written

Progresses #36. The authenticated API vertical slice remains tracked in #37; buildApp() is still health-only in this PR.

Verification

• GitHub build-test / test passed against the booted, migrated product stack, including the SQL-on-FHIR and governance integration suites
• GitHub build, typecheck, format, lint, architecture boundaries, structural checks, Semgrep, secret scan, Knip, synthetic-only scan, FHIR conformance, and SQL-on-FHIR conformance passed
• global jscpd gate: 0 clones
• independent review: clean

Local Docker Desktop did not answer its socket during the first verification attempt, so the database gate was deliberately delegated to the isolated CI stack rather than reusing an unrelated local PostgreSQL process.