VENUS-366 — schema-contract guard: SQL column references are unchecked, 6 signatures have reached prod since May

Raised by audit-venus-ca (msj2d8yd4706) as a recurring pattern; I verified it live and it is worse than reported. Measured all-time from appEvents (level in error/fatal, errorMessage matching does-not-exist / ambiguous / column-of-relation): 2026-05-13 2 x getAlumnosList relation "users" does not exist 2026-05-13 2 x getLookupsByGroup column "label" does not exist 2026-05-26..06-12 18 x getAdminLandingCounts column "status" does not exist 2026-06-23 10 x getPracticaByIdFailed column p.operadorExternoNombre does not exist 2026-07-16 1 x getFrictionDigest column reference "createdAt" is ambiguous 2026-08-07 1 x approveAccessRequestAttachFailed column "id" does not exist (VENUS-365) 6 distinct signatures, 34 events, steady at roughly one new signature per month with no downward trend. Audit listed 4; the two May ones and the exact count are mine. Why nothing catches these: SQL lives in template literals, so tsc sees an opaque string. Lint does not parse it. The generic type param on pool.query<{...}> is an ASSERTION, not a check — VENUS-365 declared <{ id: string }> against a table with no id column and compiled clean. Tests do not hit these paths because several are rare branches (VENUS-365 waited 18 days for its first caller). Proposed guard: a unit test that extracts quoted identifiers from the SQL template literals in src/lib/**, resolves each against the column list in db/schema.md (already generated and git-tracked), and fails on any reference to a column the table does not have. Catches the exact class; needs no live DB in CI; cost is a parser for the common query shapes. Does NOT catch ambiguity (getFrictionDigest) — that one needs a real planner, so scope it out or accept partial coverage explicitly rather than claiming the class is closed. Open question for design: whether to key off db/schema.md (git-tracked, can go stale) or a live introspection snapshot refreshed by db-venus-cc on every apply. schema.md is already regenerated per apply per the existing checklist, which argues for it. Class-A by blast radius (touches how every server action is validated), though the change itself is test-only.