fix: escape single quotes in LanceDB delete() to prevent SQL injection

[SinzoL]

In LanceDBStorage.delete(), the fast-path for record_ids directly interpolates IDs into the SQL expression without escaping single quotes. A record ID containing a single quote would break SQL syntax or allow injection. The touch_records() method already correctly escapes with replace("'", "''"). Apply the same escaping in delete(). Fixes #4850

---

Note

Low Risk
Low risk: a small, localized change to escaping of record IDs in LanceDBStorage.delete() to prevent malformed queries/SQL injection; behavior should only differ for IDs containing single quotes.

Overview
Hardens LanceDB memory deletions against injection/syntax errors. In LanceDBStorage.delete(), the record_ids fast-path and the category/metadata deletion path now escape single quotes in IDs (matching touch_records()/update()) before building the id IN (...) predicate.

^{Written by Cursor Bugbot for commit 1dcb6be. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[github-actions]

This PR is stale because it has been open for 45 days with no activity.