fix: serialize runtime schema initialization

[ooiuuii]

Why

Concurrent normal daemon startup and hive remote status can both observe an uninitialized runtime.sqlite, then race to insert the same schema version. In a real two-process cold-start reproduction, the status process completed migration while the daemon subsequently failed with UNIQUE constraint failed: schema_version.version and exited1.

Approach

Wrap the existing complete schema initialization body in the existing database transaction helper. Initial schema DDL acquires the SQLite writer lock before column/version inspection, retaining it through migration markers. Existing nested migration transactions use savepoints. No new lock service, INSERT OR IGNORE, schema alternative or ignored failure.

Validation

New Linux Node24.19.0 checks on2026-10-09 against main f8f1343:

• RED02:53:20–02:53:22UTC: real independent daemon and remote-status CLI processes share disposable HIVE_DATA_DIR. Both read no versions; daemon later fails inserting version1 (SQLite1555), status exits0. Integrity remainsok, markers1–45
• GREEN02:54:03–02:54:06: status waits for daemon initialization; both exit0, daemon serves HTTP, markers1–45 and integrity_check=ok
• Barrier observes existing native Database calls and pauses after a real SELECT; SQL/results/locking remain real. No SQL replica or fake startup failure
• Separate-directory processes remain independent; sequential cold/warm and normal daemon/status controls pass
• Real SQLite trigger abort at marker45 rolls back intermediate marker44, preserves prior max43 and user fixture, retains error1811; removing trigger permits retry to45 with data intact
  -51 existing focused schema/SQLite/foreign-column/legacy-driver tests passed; pnpm check/build and git diff --check passed
• Full CI-selected Linux suite02:54:38–03:04:26:2688 passed,1 failed,4 skipped across402files. Sole PTY descendant-cleanup failure freshly reproduces on main. Full gate is NOT green
• One scoped review found no blockers, including lock ordering, savepoints, rollback and legacy compatibility

Retained external runnable process/barrier/control diagnostics satisfy current runnable-self-check guidance; no new repository test file. An earlier rollback fixture incorrectly removed an already-applied migration marker; that invalid diagnostic is retained and not treated as a product failure.

Packaging: npm pack fails with ENOENT creating /home/agent/.npm/_cacache on both candidate and fresh main. Default-install and ignore-scripts pack-smoke flows were not run because no package was produced. Full CI invocation excludes package-tarball tests by repository policy. Cross-platform Node22/26/macOS/Windows native/package matrix remains unrun locally. No permissions changed. Contention proof stays within the existing5s SQLite timeout; no unlimited-wait guarantee or provider/production data involved.