Isolate Graphile plugin and storage data paths

[yyyyaaa]

Context

Part 2 of 6 in the draft tenant-density stack: #1654 → #1655 (this PR) → #1656 → #1657 → #1658 → #1659. It depends on #1654's exact runtime/pool boundary.

The old #1330 fixes were useful, but the later #1333/#1334 strategy required exhaustive SQL rewriting. This PR keeps the plugin fixes while removing that assumption: every built-in operates on the actual physical tenant schemas and exact runtime client. RLS is still row-level defense in depth, not proof that a plugin selected the right object.

What changes

• Audits and hardens the built-in raw-SQL paths in bulk mutations, function bindings, i18n, LLM/RAG, ltree, PostGIS, search, bucket provisioning, and presigned storage.
• Quotes and schema-qualifies identifiers instead of relying on canonical schema substitution.
• Makes plugin caches exact-build/request scoped and ambiguity-failing, including immutable storage snapshots and database/API-filtered fallback lookup.
• Keeps BM25, tsvector, trigram, vector, PostGIS, and ltree enabled. BM25 binds the physical schema-qualified index name; it has no rewrite exclusion.
• Removes global mutable BM25/storage-style state and closes the old withPgClient(null)/missing-request-context paths. The final Constructive preset wiring is grouped with central build composition in Build exact Graphile schemas from scoped introspection #1657.

Validation

• Frozen lockfile installation and builds passed for all nine affected plugin packages.
• Focused suites passed: bulk mutations 13, function bindings 3, i18n 7, LLM/RAG 9 changed-path tests, ltree 7, search 43, presigned storage 28, PostGIS 253, and bucket provisioning 62.
• External provider/database cases that require local PostgreSQL, MinIO, or Ollama remain explicit integration gates; they were not converted into silent passes.

Why this remains a draft

Built-in coverage does not sandbox arbitrary Node plugins. Production caller presets are denied by default in #1657, and any explicit opt-in makes that code part of the process/database trusted computing base. Full production-schema grants, multipart byte roundtrips, provider integrations, and hostile cross-tenant runs still have to pass on the final stack.