[thekevinbot]

Fixes #1611

query() denied a _dirsql_* schema read only as a lowercase PRAGMA. Now also denied:

• any letter case of the name (is_internal_table compares the prefix ASCII-case-insensitively, as SQLite does);
• pragma_* table-valued functions (pragma_table_info('_dirsql_internal_rows'), pragma_index_list(...), computed arguments): their argument is only known when the statement runs, when the pragma vtab prepares its own PRAGMA. After the guarded prepare, a narrow authorizer that denies only a PRAGMA whose value is in the namespace stays installed instead of none; a step-time SQLITE_AUTH maps to the same Unauthorized error;
• dbstat (lists every b-tree by name; no per-row filter is possible), denied at prepare.

All via the SQLite authorizer, no SQL text matching.

Red: https://github.com/thekevinscott/dirsql/actions/runs/42133043315/job/127614166360 (the three new db::tests fail on the unfixed code).

Not covered (outside the issue): SELECT name FROM sqlite_schema still lists the _dirsql_* names.

Changelog / Migrations

• Changelog fragment added under packages/rust/changelog.d/
• Migration fragment with the same slug added under packages/rust/migrations.d/

E2E Verification

• Ran e2e suites locally for every affected SDK
• Python SDK e2e: pass
• TypeScript SDK e2e: pass
• Rust core e2e (if applicable): pass (cargo test -p dirsql --lib, plus repro by hand with the release CLI)
• packages/python/e2e-attestations/bot-1611-internal-deny-1105.json receipt written
• packages/ts/e2e-attestations/bot-1611-internal-deny-1105.json receipt written
• Command(s) run: testing-conventions e2e attest 'uv run python -m pytest tests/e2e/query_contract_test.py tests/e2e/on_file_query_test.py -x -q' (packages/python, after maturin develop --release); testing-conventions e2e attest 'pnpm exec vitest run --dir tests/e2e query-contract query-params' (packages/ts, after pnpm run build)
• Result summary: Python 12 passed; TS 10 passed. Issue repro: all five queries now print the not-authorized error; pragma_table_info on a user table still works.