feat(ts): add ClickHouse trusted-query D419 runtime

[clfhhc]

Implements the approved D628 ClickHouse trusted-query execution checkpoint on top of the released 0.2.1 baseline.

• adds the host-injected ordinary-D419 runtime without ClickHouse client, SQL, credentials, or row authority
• enforces exact admission and immutable coordinate identity
• maps terminal outcomes to D610 contracts with fail-closed correlation
• supports bounded timeout, disposal, and admitted cancellation
• preserves the focused package subpath and keeps the runtime off the root surface
• adds a patch changeset for the future 0.2.2 release

Verified locally:

• focused Vitest: 24/24
• full package Vitest: 113 files, 1794 tests
• test TypeScript typecheck
• no-raw-async check
• full ESM/CJS/DTS build and package export smoke
• packed tarball ESM/CJS consumer smoke