[WAF-56] Implement SQLite test and demo repositories

Objective

Implement the same repository contracts for isolated tests and explicit single-node demos without production fleet guarantees.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-51
• WAF-52

Blocks

None

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

Complete. src/sqlite.zig (client + transactional migration runner) and src/fleet_sqlite.zig (schema + repositories), run by zig build sqlite-test against an in-memory database, so the suite needs no server.

The same repository contracts — nodes (enrollment, heartbeat, status, inventory counts, labels via JSON1), events (ingestion, per-node counts, recent search), rulesets (immutable versions, latest, rollback to a specific version), and rollout (per-node assignment, fleet-wide, convergence counts, running-version reports, drift). The guarantees are mirrored too, not just the method names: a published version cannot be rewritten, and a node that has never reported counts as drifted. A demo that behaved differently here would teach the wrong thing about the system it demonstrates (91bb0c3).

Isolated tests — openMemory gives each test a private database, so control-plane logic can be exercised with no server, no fixture files, and no cross-test state.

No production fleet guarantees, stated plainly — the module and docs/fleet-storage.md both say this backend is for demos and tests: no concurrent writers, no partitioning, no retention, not a deployment target. Signed bundles are deliberately not mirrored, because the demo profile has no fleet to distribute one to and a signature nobody verifies would imply a guarantee that does not exist here.

Build isolation: sqlite-test is its own step, so the default test/check steps stay free of the FFI and CI never needs libsqlite3.

Commits: 855384e (client + migrations), 1082487 (node/event repositories), 91bb0c3 (rulesets + rollout).