feat(sqlcore): PostgreSQL read-only WITH UPDATE through typed Mutation pipeline - #438

Feature boundary

PostgreSQL statement-level read-only WITH CTEs preceding UPDATE (including CTEs referenced from FROM or WHERE subqueries), preserving closed F# AST, Binder scope, schema/capability checks, Mutation policy, renderer, SQL parameterization and Script classification.

Do not implement WITH DELETE/MERGE, data-modifying/recursive CTE bodies, or borrow PostgreSQL grammar for other providers. No new SQL-execution API.

TDD

1. RED: positive multi-CTE grammar and UPDATE/RETURNING, reject unbounded UPDATE and target allowlist bypass, cross-provider source negative matrix, contextual CTE names.
2. GREEN: typed Update CTE field propagated through Binder, validation, inspection and renderer; no raw SQL splicing.
3. PostgreSQL live execution parity and strict schema proof.
4. Require all 16 Tests jobs and independent SqlCore baseline comparison green on the exact PR head; only then squash merge to develop. Never push main.