M0: first check end to end, read-only engine and CI

[hazeliscoding]

Milestone M0 from ROADMAP.md. The decisions it builds on are recorded there (2026-09-25).

• Checks compile into the binary. A source generator reads checks/<id>/. A broken check fails the build with its file and line, as does SQL that calls a function a READ ONLY transaction doesn't stop, or one that runs SQL from a string.
• Guarded session. Every statement runs in BEGIN TRANSACTION READ ONLY with SET LOCAL statement and lock timeouts and search_path = pg_catalog, pg_temp, then rolls back. Nothing is set for the whole session, so nothing leaks through a transaction pooler.
• First check. replication-slot-inactive has fires and healthy fixtures on Postgres 14 to 18. Each fixture gets a fresh Testcontainers Postgres, and the check runs as a role with only pg_monitor.
• CLI. pgcheckup scan prints the terminal report and exits 0, 1 or 2. pgcheckup list lists the checks. Connections come from a postgres:// URL, a libpq key-value string or the PG* variables. Errors never repeat the input.
• CI. Tests run on Postgres 14 to 18. A linux-x64 NativeAOT publish fails on any IL warning, then the published binary must report an inactive slot and exit 1 with --fail-on warning.