fix(cli): generated SQLite/libsql service command omits --allow-ffi — DB-backed scaffold service exits 1 at startup

[rickylabs]

Found by the OMB wave-0 proof run (PR #1182) during the 0.0.5 milestone orchestration — the same published-artifact defect class as #1184: generator-emitted output broken on a real scaffold, invisible to engine tests.

Observed (evidence in .llm/runs/test-openapi-mcp-wave0-proofs--wave0/proofs/evidence/, P1-runtime.json + P2-db-failure.json): on a fresh scaffold with the SQLite/libsql database template, the generated service's run command lacks --allow-ffi, which libsql requires. The service exits 1 and Aspire describes it Finished/unhealthy with no resource URL. Consequences already paid: the P1 proof could not meet its coherent-owned-run bar on a DB-backed service (contributing to the conservative F1(b) selection), and P2's required DB-branch spec measurement is blocked.

Acceptance

• The generated command for SQLite/libsql-backed services includes --allow-ffi (emitted by the generator — a template/command-builder fix, not a user edit)
• RED first: a fresh scaffold on today's generator shows the exit-1/unhealthy service; the same scaffold after the fix starts healthy (state Running, healthStatus Healthy with populated healthReports)
• A generated-output test covers the emitted command's permission set, failing without the fix
• Permission emission is audited for the other DB templates (Postgres/MySQL/etc.) — each either proven unaffected or fixed in the same pass, with the audit recorded
• The blocked P2 DB-branch measurement is re-run against a fixed scaffold (proofs/experiments/p2-measure-live-spec.ts), P2-db.json appended to the wave-0 evidence, and any contract impact for OMB S4/S6 recorded on epic Epic: OpenAPI→MCP service introspection — agent-legible service APIs #1126

Verification bar: the owner's seven-point protocol applies (real scaffold, genuine health, OTEL evidence where a live call is claimed, artefact not exit code).

Refs #1182 (discovery), #1184 (defect-class sibling), #1126 (unblocks the P2 DB branch).