Sync upstream v1.31.1 and isolate wicked Go code generation

[Stumble]

Summary

Merge upstream sqlc v1.31.1 into the wicked fork and isolate wpgx code generation
in internal/codegen/wicked, without requiring a separately installed plugin.
Keep the existing sql_package: wpgx, schema ordering and comment-option syntax.

Architecture and key decisions

• Compiler owns SQL analysis and supplies primary-schema/model and top-level
  SELECT facts through WickedMetadata; the backend owns Go mappings, templates,
  cache keys, timeout, invalidation and replica APIs.
• Custom options use standard query comments instead of a custom Query.options field.
• Generic compiler fixes remain independent commits in this fork. No upstream PR
  has been opened; that is a later contribution after whole-fork validation.

Compatibility follow-up

Additional baseline/consumer review exposed gaps not covered by the original
bookstore-only verification. Follow-up commits cead568ed and 62d9e5b26:

• Restore Google UUID type identity, inherited primary models, legacy exec Row
  declarations and column-scoped JSON tags.
• Preserve parameter context/nullability by fixing duplicate unaliased relation
  indexing, instead of promoting all assignment contexts. Keep explicit narg
  behavior and true self-join ambiguity checks.
• Restore consistent Docker/make/CLI/generated-code release versions, tested by
  building and running a real binary.
• Add a v2.3.4-derived generation fixture with consumer compilation and actual
  old-JSON round trips in CI; broaden PostgreSQL type/import regression tests.

Same-input regeneration in eight local consumer repositories covers 226 query
sets. All newly generated Go files match the v2.3.4 baseline except version
comments. Existing checked-in consumers on older fork versions additionally
pick up the already-existing nil-cache/concurrent-invalidation fixes; one
historically edited generated wrapper normalizes back to the template.
No consumer business code, configuration or production schema was changed.

Verification

• Focused compiler/backend/cmd/config tests with CGO enabled and disabled.
• Full examples/upstream suite with owned PostgreSQL/MySQL containers:
  GOMAXPROCS=2 PATH="$PWD/bin:$PATH" go run ./scripts/test-local -- go test -p 2 -parallel 8 -count=1 -tags=examples -timeout 20m ./...
  (endtoend: 144.467s).
• GOTOOLCHAIN=go1.26.8 make build-endtoend; generated consumer/JSON fixture tests.
• CGO and non-CGO binaries pass bookstore regeneration/diff; its 17 files remain unchanged.
• Fresh bookstore tests, race tests and make lint-fix pass with isolated PostgreSQL/Redis.
• 147 two-version generation cases: 113 successful identical outputs, 23 explained
  differences, and separately classified invalid/pre-existing broken cases.
• govulncheck using Go 1.26.8 reports zero reachable vulnerabilities (not a claim
  that every imported module is vulnerability-free).
• Buf/protobuf boundary is unchanged by the follow-up; original generation/lint
  and standard-plugin tests remain covered. Credential scan passes.

Seven consumer repositories and their local workspace modules compile fully.
For trex, regenerated files differ from its checked-in source only by version
comments, its generated repositories compile locally, and the exact existing
source commit has passing CI/lint/image-build checks. Local trex full-build
limitation: the large CCXT dependency exceeds this environment's memory soft
limit; default and reduced-optimization attempts were cancelled, not counted
as passes. No dependency, business source, or host resource limit was changed.

Breaking changes and retained limits

• The internal fork plugin protocol changes; old custom plugin binaries must be
  rebuilt. This is not a separately installed plugin migration for normal users.
• Qualified built-in types that previously degraded to interface{} are now
  recognized. A standard INSERT/SELECT fixture also now retains inferred non-null
  types instead of losing them through a database fallback; both analysis modes
  are tested. These are documented inference improvements, not unexplained rewrites.
• Legacy top-level SELECT classification is retained, not a complete proof of
  read-only SQL. Ordinary-view primary models, wicked batch/last-ID commands and
  database-only analysis remain unsupported. Copyfrom does not implement cache/invalidate.
• No production migrations or downstream wpgx/dcache dependency upgrades.

Related PR and merge order

Runtime example: Stumble/bookstore#2.
Merge this sqlc PR first, then the example. No automatic merge or release.

Full design, audit disposition and verification evidence:
docs/changelogs/2026-09-08-sync-upstream-and-separate-wicked-codegen.md.

[Stumble]

Superseded by #17, which applies the verified implementation directly on the exact upstream v1.31.1 commit in two linear commits: core changes, then the wicked backend. The new PR CI passes. Product files are unchanged; only publication documentation was updated. The old refactor/upstream-sync branch and legacy main are retained without force-pushing. Please review #17 instead.