fix(sqlite): isolate bundled SQLite from host libraries

[VanshKhanna]

Host applications that link another SQLite implementation can resolve WalletKit's native sqlite3_* calls to that library. With Apple's system SQLite selected, the cipher check added in 0.22.0 returns no row and storage initialization fails with sqlite error 101: query returned no rows.

Compile the checksum-pinned sqlite3mc amalgamation with its SQLite C API given internal linkage, expose only 21 WalletKit-prefixed wrappers to Rust, and retain the existing cipher, key encoding, and database format. A missing cipher now reports an actionable backend-isolation error. Add native link-order regression checks to macOS CI and a frozen encrypted fixture generated with the original library.

Before/after evidence:

• Built the identical checked-in Rust probe and C host against release v0.22.0 (c6f8c06) and this fix. The control checkout adds only the probe/example registration; production code is unchanged.
• With system SQLite linked first, the original release exits 1 with WalletKit SQLite link regression: sqlite error 101: query returned no rows.
• The fixed probe exits 0 with either library order in both debug and optimized release builds, with dead stripping enabled. The host retains its own system SQLite engine.
• The probe checks encrypted file contents, correct-key reopening and record preservation, wrong-key rejection, and preservation of existing bytes after failed opens. Existing plaintext databases are rejected without modification; no migration or reset is introduced.

Additional local validation:

• cargo test -p walletkit-sqlite -p walletkit-db --locked: 22 tests passed, including the frozen pre-fix encrypted database, envelope bytes, and content IDs.
• cargo clippy -p walletkit-sqlite -p walletkit-db --all-targets --locked -- -D warnings, Rust formatting, and ShellCheck passed.
• cargo build -p walletkit-sqlite --target aarch64-apple-ios --target aarch64-apple-ios-sim --locked passed.
• Native archive inspection rejects exported or unresolved unprefixed sqlite3_* symbols.

Validation limit: this proves the reproduced library-resolution failure is fixed. It does not yet confirm the cause in the reporting application's final binary. Before release, verify authenticator/storage initialization and credential access in that app on fresh and existing encrypted stores. Full device runtime, Android integration, and the affected app's linking configuration have not been validated locally.