feat: prototype commit finalizers for operation-wide publication

[nicolasburtey]

Summary

PoC lifecycle support for operation-wide outbox publication envelopes. Independent publishers can register work during different/reentrant commit-hook generations; an ordinary merged hook cannot know that it has seen the final contribution.

• Add opt-in CommitHook::is_finalizer() (default false).
• Drain all ordinary hooks, including reentrant generations, before finalizers run.
• Keep pending finalizers mergeable while ordinary hooks accumulate contributions.
• Roll back if a finalizer registers any further hook instead of silently reopening a sealed publication.
• Preserve dependency ordering within each phase; ordinary dependencies on finalizers fail as cycles.

This is the upstream lifecycle dependency for Obix #149 and Lana DW integration #8871. Based on release 0.12.21 to match the integration's dependency graph. No Cala patch is needed.

Validation

• Two finalizer tests pass: late/reentrant ordinary generations and rollback on illegal finalizer registration.
• SQLX_OFFLINE=true cargo check -p es-entity --lib passes.
• Formatting and git diff --check pass.
• Strict standalone Clippy encounters unchanged clippy::useless_conversion findings in src/query.rs:86,96. Changed library/test targets pass with --no-deps -- -D warnings -A clippy::useless_conversion.
• Companion Obix/Lana integration tests also exercise savepoints, source rollback, mirroring, and foreign-sink replay.

Scope

Draft architectural PoC, not a release request. Finalizers may perform SQL but cannot register more hooks. Multiple finalizers taking shared locks still need a canonical lock order in callers; this phase is not a deadlock-avoidance mechanism.