feat(storage): add SQLite session metadata foundation

[likun666661]

Part 1 of #1370.

What changed

• add a versioned SQLite schema for canonical SessionHeader payloads plus indexed recency, flag, status, parent, revision, and label projections
• add transactional create/read/list/update/delete APIs with metadata-version CAS and fail-closed validation
• add source-marked, whole-catalog legacy JSONL header import that is idempotent and rolls back atomically
• reuse the existing FileSessionStore compatibility codec so legacy defaults migrate exactly once
• verify that session metadata tables coexist with the RuntimeEvent schema in one workspace database

Scope boundary

This foundation PR does not change production SessionStore wiring or defaults. Existing workspaces continue using file-backed headers until the follow-up cutover PR. StoredMessage transcript bodies remain JSONL.

Why

Session metadata updates currently rewrite the complete transcript and session listing walks file headers. This PR establishes the durable/queryable layer separately so the default cutover and legacy-format cleanup can be reviewed independently.

Validation

• npm test --workspace @maka/storage — 430 passed, 1 skipped
• targeted Biome format and lint — passed
• npm run typecheck — @maka/storage and preceding workspaces passed; the all-workspace command remains red on unrelated current-main CLI declaration drift and a Desktop test fixture ComposerHandle.setSkills mismatch

Follow-ups

• PR 2: migrate existing workspaces and make SQLite the default canonical SessionStore metadata writer
• PR 3: remove JSONL header authority and finish export, downgrade, backup, and E2E coverage