Recover pooled connections after failed transaction completion - #100

A failed outermost COMMIT can leave a native transaction open after the managed session releases its connection to the pool. A deferred foreign-key violation, for example, can then expose rows from the failed transaction to a later operation.

Check SQLite's autocommit state while the session still owns the connection, and roll back an active transaction without inheriting cancellation. If the state cannot be verified or cleanup leaves the transaction active, fail the entire pool closed and require the owner to close and reopen the database. Discarding and silently replacing a connection could otherwise lose an in-memory database, attached databases, temporary objects, or other connection-local state. Preserve the original transaction-end failure and attach cleanup failures as suppressed exceptions.

Reject reentrant completion of the outer transaction before changing its success state, and release assigned or queued waiters safely if the pool becomes unusable. Raw transaction SQL via rawExecSQL is outside the managed transaction recovery contract.

Validation on an Android API 36 arm64 emulator:

• 22 upstream instrumentation tests cover deferred constraints, cancellation, automatic native rollback, real commit-time I/O failure, SQLITE_FULL, in-memory and URI databases, attached and temporary schemas, reentrant completion, and connection-pool waiter races.
• A separately built 4.17.0 backport uses the official 4.17.0 native SQLCipher core. The 22 recovery tests passed against its release AAR; the rebuilt and official libraries read each other's encrypted database writes and both report the libtomcrypt provider. A broad upstream suite passed on one emulator; on a second, existing tests intermittently reported I/O errors and passed in isolation.
• An earlier version was also exercised with test-only native gates for cancellation during native COMMIT. These gates are not shipped; see verification/native-commit-cancellation/README.md.

Cancellation is cooperative, and a short COMMIT can complete before a progress callback runs. A failed COMMIT does not establish whether its changes were durable. Coverage is limited to the tested Android version and architecture.

Fixes #101