feat: complete the SQL Server plugin — protocol, packaging, explain

[debba]

Summary

Completes the SQL Server driver after the mssql-tds bridge migration in #1:

• implements the remaining host protocol surface: connection strings, BLOB export/preview, initialization settings, database users and privileges, and a pool-draining shutdown;
• upgrades .tabularium, assets, documentation, developer tooling, CI and release workflows to registry quality;
• moves SHOWPLAN parsing to the plugin-owned TypeScript package and ships its isolated parser IIFE;
• hardens SQL construction, paging, type round trips, error/session recovery, host-model conformance, queues, result retention and pool eviction.

PR #1 is merged. This PR has been retargeted from feat/mssql-tds-bridge to main; GitHub reports it clean and mergeable, so no history rewrite was needed.

Important

BREAKING CHANGE: explain_query now returns raw
sqlserver-showplan-xml instead of a Rust-parsed plan. The plugin therefore
requires Tabularis v0.23.0 or later, the first intended host release with
raw plugin EXPLAIN support and plugin parser-bundle loading. Older hosts cannot
render Visual EXPLAIN from this plugin.

What changed

Protocol and driver

• URL and ADO.NET/ODBC connection strings with canonical pool keys
• Bounded BLOB preview and raw file export, including composite PKs
• Manifest-backed pool, timeout, TDS identity, TLS trust and eviction settings
• SQL login/database-user lifecycle and DENY-safe privilege management
• Deliberate materialized-view exclusions and complete RPC dispatch coverage
• SQL Server-number-aware errors, credential redaction and poisoned-session replacement
• SQL Server paging lookahead, multi-result isolation and a 10,000-row safety ceiling
• All 37 advertised types covered by the live round-trip matrix

Plugin-owned EXPLAIN

• @tabularis/explain-sqlserver ESM package and direct parser API
• explain/dist/index.iife.js for isolated desktop loading
• Six captured SQL Server 2022 golden SHOWPLAN fixtures
• Raw sqlserver-showplan-xml plugin response and Rust parser removal
• Manifest parser declaration and Tabularis 0.23.0 runtime floor

Core support is in TabularisDB/tabularis#688, and standalone-site support is in TabularisDB/explain-plan#2.

Release quality

• Registry-grade manifest, icon and eight screenshots
• Five-platform release matrix and standalone manifest asset
• Rust, SQL Server 2022, TypeScript, manifest, Markdown and audit CI
• Conventional Commit title and prerelease-channel version checks
• Host-model conformance fixtures for every implemented RPC
• SQL/identifier audit and measured pool/process performance baseline
• Dependency provenance, exact preview pins and rollback policy

Verification

The repository gate covers:

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo build and cargo test --bins --test conformance
• 26 live JSON-RPC tests against SQL Server 2022
• pnpm typecheck, 13 parser tests and pnpm build under explain/
• manifest, Markdown, workflow and release-version assertions

The final SS-046 gate result and exact counts are recorded in the completion commit and project progress ledger.

Publication status

This PR is ready for code review, but it must not be tagged or registered until its upstream dependencies exist. There is currently no plugin release, @tabularis/explain 0.2.0 and @tabularis/explain-sqlserver are not on npm, core PR #688 is still open, its explain_parsers schema is not deployed to the live registry validator, and the site change is not deployed. CI validates all deployed manifest fields against the live endpoint and checks explain_parsers separately against the frozen contract until that additive schema is deployed. Full live-schema validation remains a publication prerequisite. Release URLs currently return 404, so no broken registry PR was opened.

Issue #4 is the actionable follow-up checklist for upstream merges, licence/notice resolution, npm publication, all five release assets, archive inspection, real-desktop Visual EXPLAIN validation, registry submission, production site deployment and closing #2. Issue #2 remains open until those shipped links exist.

Review notes

• SQL authentication remains the intentional scope; Azure AD and Windows Integrated Authentication are not added.
• Custom CA files and client certificates remain unsupported; strict TLS uses the system trust store.
• Primary-key membership alteration remains disabled because the host's single-column API cannot safely preserve composite keys.
• SQL Server indexed views are not presented as refreshable materialized views.

[github-actions]

Version suggestion

Based on this PR's title (feat) and the prerelease:beta label:

Current	0.1.0
Suggested next tag	v0.2.0-beta.1

This is informational only — no tag or release is created automatically yet.