Release hayate-sql 0.1.0 with real D1 verification

[yhay81]

Summary

• preserve the discovered implementation as the auditable root commit
• add a real workerd + local D1 gate for :one, :one?, :many, and :exec
• verify telemetry excludes SQL text and bound values
• make generated facades compatible with strict Ruff consumers and projects that forbid postponed annotations
• add migration incompatibility regression coverage and guarded Trusted Publishing workflow

Dogfood evidence

FolioMCP compiles seven production D1 contracts against all nine migrations. The selected maintenance and ingest paths remove handwritten bind order, cardinality, and result-shape handling; focused mypy and 46 regression tests pass.

Verification

• ruff check / ruff format --check
• strict mypy for package, scripts, and Workers probe
• 41 pytest tests
• D1 migration replay, including deliberately incompatible query
• real Wrangler 4.114.0/workerd local D1 execution from the built wheel
• pip-audit, zizmor, wheel and sdist build