LeanDB 0.4.0

LeanDB 0.4.0 lands the LeanGD engine surface (LDB-01 … LDB-11). Defaults stay byte-identical to 0.3.x (synchronous=FULL, 5s busy timeout, audit log .all).

• LDB-01. transaction / withTransaction / untrackedSqlite and LeanDb.Runtime.Service: BEGIN IMMEDIATE at depth 0, savepoints when nested, typed .abort, poisoned connections after a failed ROLLBACK, serialized withConnection, drain/resume/snapshot/restore/close.
• LDB-02. OpenConfig (synchronous, cache_size, mmap_size, wal_autocheckpoint, allowlisted extraPragmas) plus LEANDB_* environment overrides.
• LDB-03. Indexes α declares indexes and composite UNIQUE constraints; they appear in DDL, schema JSON, the fingerprint, and migrate add/drop plans. Child tables get (parent, position) UNIQUE.
• LDB-04. selectP takes a pushed Order and Window (LIMIT / OFFSET); a Lean-side sort plus a limit is refused. Tie-break is , id ASC.
• LDB-05. LogConfig.verbs (all / failuresAndPlans / failuresOnly / none) and sampleEvery; CLI default remains .all.
• LDB-06. count / countP / exists? / existsP push COUNT(*) / EXISTS when the predicate has no residual.
• LDB-07. Typed patch with a Pred guard; PatchResult is .updated / .notFound / .guardFailed.
• LDB-08. insertMany and keyset scan.
• LDB-09. Runtime.Config.readers and Service.withReader; write verbs on a read-only connection return DbError.readOnly.
• LDB-10. deriving instance LeanDb.ClosedEnum / DbJson / Inline works post-hoc on LeanDB-free domain types.
• LDB-11. Extra tables in a fingerprinted instance are tolerated; Base.auxiliary declares FTS5 objects; searchP binds MATCH.

Also in this release: JSON true/false only on Bool columns; colliding table names are refused; --db is taken only before the verb; WAL + deferred snapshots; HTTP Host/Origin pin and JSON Content-Type requirement; restore-safety path shared with the runtime.

Lean 4.33.0 and the pinned SQLite dependency are unchanged.

Validation: lake build LeanDb, lake build leandb, and .lake/build/bin/leandb_tests (all engine tests passed).