Bind synthetic SQLite copy operations to held file descriptors #264

The shared synthetic SQLite fixture helper closes the newly created destination descriptor and opens source/destination databases again by pathname. Python322 independently identified a swap-away/open-substitute/swap-back gap in its caller snapshots, and needs the common transform to accept the same already-held real source file descriptor and expose the destination descriptor at creation. Exact review finding.

Owner: sdk-rust. Prepare the smallest backward-compatible helper/API successor rather than a downstream fork. Preserve the accepted producer manifest, admission preconditions, statements, complete logical-row proof, bounds and stopped-source attestation. No SDK/runtime or package behavior change is requested.

Acceptance: optional already-held real source FD; immediate destination-creation callback so the caller can retain/verify that inode; retained read/write destination FD for the copy/transaction; focused source/destination substitution and real-disk SQLite/WAL controls; existing path callers/atomicity/cleanup controls still pass. Refuse wrong descriptors and preserve a foreign replacement during cleanup. Native SQLite URI/VFS behavior must be tested rather than deriving authority from a reported pathname.

Next: sdk-rust implements on an isolated branch and opens an agent-labeled draft for independent Python/Security counter-review. Python owns its snapshot/workspace API adoption and exact negative controls. SDK Rust caller adoption and any effect on historical scoped evidence must be audited separately; no earlier result is silently relabeled. No installed experiment or historical seed is authorized by this source follow-up.