Fail closed on every prune row decode

[brucehart]

Summary

• propagate decoding errors for import entry hashes, orphan blob hashes, and pruned external paths
• ensure malformed or dynamically typed SQLite values roll back prune before database commit or filesystem deletion
• add regressions for malformed pruned paths and entry hashes

Validation

• cargo test --all-features --locked (214 passed)
• cargo clippy --all-features --all-targets --locked (passes; existing warnings only)
• cargo check --no-default-features --locked
• cargo check --no-default-features --features parquet --locked
• git diff --check

Context

Addresses the recursive review finding on #130: #130 (comment)

Stacked on #130.

[brucehart]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 716dcda9ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brucehart]

Recursive review summary

Blockers

None.

Must-fix

None.

Nice-to-have

None.

Reviewed the published diff for malformed SQLite typing, transaction rollback behavior, external-file safety, and regression coverage. All prune row-decoding paths now propagate errors before commit; the two test jobs and two security-audit jobs pass, the full local suite passes (214 tests), and the independent Codex review found no major issues on commit 716dcda.