users.updatedAt not DB-maintained — raw SQL writes leave it stale

coder-venus-cc found while writing VENUS-305's bindColumnWithEvent: users.updatedAt is APP-maintained only, not DB-maintained (users' only trigger is preventNestedPersona — no BEFORE UPDATE touch trigger exists). Confirmed live: db-venus-cc's raw UPDATE bound 2 authId/googleSub rows and updatedAt still reads the row's original createdAt value. Any raw-SQL write to users (migrations, db-lane repairs, ad-hoc UPDATEs) silently leaves updatedAt stale. Nothing may treat users.updatedAt as authoritative for change detection, cache invalidation, sync, or 'recently modified' reporting until fixed. Fix: a BEFORE UPDATE DB-side trigger (matches the pattern already used elsewhere for auto-touch columns), OR failing that a documented fleet-wide ban on trusting this column specifically. Also cost us the ability to reconstruct a real bind timestamp for the 34 pre-invariant rows in VENUS-308 bucket (1).