perf: cut the 15.8s cold-start stall (exploration 0233, Wave 1)

[crs48]

Implements Wave 1 of exploration 0233 — the cheap, safe cold-read mitigations. The boot-debug trace (enabled by #288) finally named the culprit in one line:

[xNet] sqlite op query {"lane":"interactive","queueMs":0,"execMs":15858}

One landing query, 15.8 s of real execution, queueMs:0 — and every op after it execMs:0. That's a cold OPFS page-in of the first query's working set on the single SQLite worker; the 256 MB page cache only helps re-reads, so it never touched the first read. The file is large/fragmented (a 424k-row append-only change log + 1.3M-row scalar index grown interleaved), so the cold read faults pages scattered across it.

What's in this PR

• B1 — PRAGMA mmap_size (web.ts): memory-map reads so the first cold query faults via the OS instead of thousands of synchronous 8 KiB reads. Guarded — a no-op where opfs-sahpool doesn't support it. This is the lever for the first read.
• A3 — one-time idle VACUUM (db-vacuum.ts): defragments the OPFS file so subsequent cold boots fault a smaller, denser working set. Mirrors the 0229 presence cleanup (one-shot, localStorage-gated, idle-scheduled, off the critical path, never throws). Logs file size before/after — which also captures the db stats measurement the doc asked for.
• C2 — defer the prewarm fan-out (WorkingSetPrewarm.tsx): mounts the five prewarm subscriptions one animation frame late so the active route's own query reaches the worker first and is the one that pays the cold read and paints.

Deliberately deferred (separate, focused PRs)

The doc is a multi-wave plan that gates later waves on measurement and touches the protocol kernel — implementing them blind here would be reckless:

• Capture db stats / instrument the ~4.4 s secondary gap — runtime observations; A3 now logs the file size, and the rest needs a live capture against the user's OPFS data.
• C1 instant-shell snapshot — a new persistence + write-through + render path; its own feature.
• A1 change-log compaction + A2 split changes DB — changes is the signed, hash-chained protocol kernel (0200, golden vectors). Pruning it needs a spec + cross-impl test updates.
• D1 WASM stream-compile (~1 s, secondary) and D2 hub redeploy (ops; clears the orthogonal INVALID_HASH).

The 0233 doc stays [_] (3/10 implementation items done) — Wave 1 lands here; the architectural waves follow with measurements in hand.

Test plan

• New db-vacuum.test.ts (3 cases: opfs vacuum+latch, memory-skip-no-latch, flag no-op).
• @xnetjs/sqlite + apps/web: typecheck clean, full suites green (677 tests in touched areas).
• Pre-push full-suite "failures" were a core.bare flip from the hook's own pnpm install breaking devkit git tests — all pass with healthy git; none are in touched code.

🤖 Generated with Claude Code

[github-actions]

🖼️ UI changes in this PR

No visual differences detected in the changed UI.

_{CI run}

[github-actions]

Preview removed for PR #290.