fix: refuse a missing index and stop hiding pending-refs check failures (#111, #110)

[inth3shadows]

Summary

• db.connect creates an empty codegraph.db when --db points at a missing path #111. sqlite3.connect creates a missing file. A mistyped --db used to leave a 0-byte database behind, and the run then died with no such table: files. db.connect now raises IndexMissing (a FileNotFoundError) and creates nothing. select and export print no CodeGraph index at <path> and exit 2. :memory: still opens.
• integrity: except Exception: pass hides every failure of the pending-refs check #110. The pending-refs check sat under except Exception: pass. A missing unresolved_refs table, a missing status column or a locked database switched off the mid-resolution guard without any message. It now catches only sqlite3.Error and adds a warning, so select reports an empty answer as UNKNOWN rather than NONE. Any non-sqlite error is a testgraph bug, so it now propagates instead of being reworded as a warning.

Both issues were labelled needs-verification. Both reproduced on main before this fix: a typo'd --db left a 0-byte file, and with unresolved_refs dropped, check() returned no blocking entries and no warnings.

Testing

• python3 -m unittest discover -s tests: Ran 484 tests ... OK (477 before, 7 new).
• I reverted each fix and re-ran the new tests, and each revert made them fail. Without the connect existence check, MissingIndexTests gave FAILED (failures=1, errors=1). With the silent pass back, IntegrityTests gave FAILED (failures=4). Without the IndexMissing catch in select.main, FAILED (errors=1).
• The CLI by hand: select --db <missing> exits 2 with the message, and no file is created.

Closes #111
Closes #110

Review round 1 (dual review), fixed in 7f235f8

• connect now opens with mode=ro, so nothing can create an index. It refuses a path that is not a file or that has no files table. That covers the 0-byte file the old bug left behind, a directory passed as --db, and any sqlite file that isn't an index.
• When the schema pin matches, a missing unresolved_refs table or status column now blocks. A warning only demotes an empty answer to UNKNOWN, so a non-empty journey list would still have read as confident. It still warns when the schema is unpinned or differs.
• The messages now say "check the path" before codegraph init. A missing table and a missing column are worded differently.
• All 9 new tests were written first and failed before the fix. After the merge with main: Ran 493 tests ... OK. select returns OK on testgraph, honeyslate and signedintake.

The remaining findings are filed as #126, #127, #128 and #129.

Review round 2 (verify): NOT clean, so not merged yet

Open defects in 7f235f8, to fix before merge:

• R2-1. The blocking message for a missing table at a matching pin says to run codegraph init. On an existing index, init does nothing; the advice should be codegraph index <repo>.
• R2-2. Both reviewers found this one. connect's except sqlite3.DatabaseError around the files probe reports a lock, or a read-only directory with no -shm, as "not a CodeGraph index". Only "not a database", "malformed" or no files table should mean that.
• R2-3. A read-only connection can't roll back a hot journal, so a rollback-journal index whose writer was killed is refused. WAL indexes are unaffected.
• R2-4. An OperationalError raised by the open itself (for example a chmod 000 file) escapes as a traceback with exit 1.
• R2-5. Whether to block or warn is decided by matching sqlite's English error text. It should use PRAGMA table_info / sqlite_master instead.
• R2-6. found == schema_pin in the new condition is redundant.
• R2-7. No WAL fixture covers the read-only connect.
• R2-8. The skip warning repeats itself.
• R2-9. An index older than schema 8 with a matching pin now blocks with the wrong message. No registry pins that low.