fix(goose): detect WAL-only session updates

[pitimon]

Summary

• replace Goose's main-file-only mtime shortcut with a SQLite change fingerprint covering the DB plus -wal, -shm, and -journal
• fingerprint sidecars with bigint file size and nanosecond mtime
• force legacy Goose cursors through one read before establishing the new fingerprint
• add a real WAL regression test where the main DB mtime remains unchanged while committed cumulative usage grows in the WAL
• retain the v0.39.46 cross-midnight observation-bucket policy and bump release metadata to 0.39.47

Root cause

Goose snapshots SQLite sidecars for correctness but its fast path only compared sessions.db mtime. In WAL mode a committed active-session update can change only sessions.db-wal, causing TokenTracker to return early without observing the new delta.

Verification

• WAL regression failed before the fix (eventsAggregated: 0)
• WAL regression passes after the fix
• main DB mtime is asserted unchanged in the fixture
• WAL size/mtime is asserted changed
• cross-midnight start and observation buckets are asserted
• Goose + reset focused tests pass
• npm run ci:local passes
• version lockstep, OpenWiki facts, package/publish dry-run, diff and security checks pass

Release

• npm target: @ipv9/tokentracker-cli@0.39.47
• pricing seed change is timestamp-only; model count remains 2525

Closes #161

[pitimon]

Release verification complete:\n\n- independent fail-closed review passed after resolving WAL detection, incomplete-stat, sidecar-copy, and Node 20 test-portability findings\n- npm: @ipv9/tokentracker-cli@0.39.47 published and latest verified\n- CI: final PR ci:local passed\n- GitHub Release: https://github.com/pitimon/TokenTracker/releases/tag/v0.39.47\n- macOS DMG and Windows artifacts published and reachable\n- local dashboard/local-sync pinned to 0.39.47; dashboard serves v0.39.47 with HTTP 200