Make sensitive rewrites and prune cleanup atomic

[brucehart]

Summary

• stage redaction and PII output databases until the rewrite and sensitive-data cleanup complete
• make PII entry rewrites transactional and defer prune filesystem deletion until after database commit
• preserve external files that remain referenced by surviving blobs
• add rollback, failed-publication, forced-overwrite, and shared-path regressions

Validation

• cargo test --all-features --locked (201 passed)
• cargo clippy --all-features --all-targets --locked (passes; existing warnings only)
• cargo check --no-default-features --locked
• cargo check --no-default-features --features parquet --locked
• git diff --check

Context

Addresses the must-fix findings from the recursive review of #128: #128 (comment)

Stacked on #128 so the original security-hardening PR remains unchanged.

[brucehart]

@codex review

[brucehart]

Recursive review summary

Blockers

None.

Must-fix

• [medium] Fail closed when decoding surviving external paths. src/commands/prune.rs collects the rows with filter_map(|row| row.ok()), so a non-TEXT SQLite value is silently omitted from external_paths_in_use. SQLite allows dynamic types even in this TEXT-declared column. I reproduced a surviving blob with the same path stored as BLOB: prune committed successfully, deleted the shared file, and left the surviving blob reference in the database. Propagate row-decoding errors before commit instead; malformed/untrusted databases must preserve both the transaction and filesystem. Affected code

Nice-to-have

None.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e987692da9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brucehart]

Addressed the must-fix finding in stacked PR #130: #130

Prune now propagates surviving-path decoding failures and rolls the transaction back before filesystem deletion. The regression reproduces a dynamically typed SQLite BLOB path and verifies the shared file, import, and orphan blob are all preserved. The same change also cleans rollback-journal sidecars for staged databases. Full validation passes (204 tests).