feat: integrate semantic read queries into db ask

[gcomneno]

Closes #71.

Summary

Integrates the GiadaWare AI semantic read-query interpreter into db ask while keeping Cifrolotto authoritative over SQL validation and execution.

The implementation introduces:

• a versioned Cifrolotto-owned semantic query context;
• free Italian and English semantic interpretation through GiadaWare AI;
• explicit accepted, unsupported, and ambiguous outcomes;
• deterministic grounding for current and previous civil dates;
• independent SQLite structural authorization;
• declared relation, column, function, and parameter enforcement;
• read-only mode=ro execution with query_only;
• runtime SQLite authorizer enforcement;
• row and execution-time bounds;
• CLI discovery, rendering, localization, and documentation;
• an opt-in real-runtime qualification procedure.

The superseded fixed-intent natural-query prototype is removed.

Security / authority boundary

Model-generated SQL remains untrusted.

Cifrolotto independently rejects:

• undeclared relations or columns;
• queries that do not read a declared Lotto relation;
• DML and DDL;
• PRAGMA, ATTACH/DETACH, transaction and administrative operations;
• undeclared functions;
• mismatched parameters;
• multiple statements;
• direct access to underlying tables hidden by the declared view.

Runtime execution remains read-only and bounded.

Validation

• 465 tests passed
• 2 integration tests skipped because their external database fixture is unavailable
• production-shaped SQLite view regression passed
• real canonical Lotto database smoke test passed
• SELECT 1 and VALUES(1) fail closed
• case-insensitive SQLite identifiers verified
• initial functional SQL envelope covered:
  • latest/current/yesterday
  • date ranges
  • all/any/exclusion
  • grouping
  • wheel comparisons
  • deterministic empty results
• staged/worktree diff checks passed

Commit:

6ff339782d33651f3eb9f48c92c819d0966675d6