Fix destination SQL, TLS and resource ownership; add measured build benchmarks

[somethingwithproof]

Superseded by the recovered implementation in #655 and #656 and the measured benchmark documentation follow-up #658. This branch is preserved to retain the exact historical benchmark revisions; it must not be merged as a competing implementation.

Spine can choose an upsert syntax from the wrong database version, weaken TLS checks across retries, and release resources without a checked borrowing or worker lifetime. This change selects syntax from each connected destination, applies explicit TLS policies independently to local and remote connections, and joins bounded workers before pool destruction.

Database leases now validate slot, generation, destination and borrowing thread. New ownership modules have mandatory 100% line and branch coverage gates. The common polling cleanup closes sessions for empty devices and defers cancellation until its leases and buffers are released. Script cancellation releases only an acquired permit; optional limits enforce complete bounded output, successful exit and Linux child CPU/memory/file/descriptor caps. Unset script limits retain the existing result contract.

The series also adds checked opt-in JSON logging with independent parser-backed tests, a nightly suite-manifest gate, and a manually dispatched paired-build benchmark. The benchmark keeps the toolchain, server, devices, thread count, TLS policy and workload identical, alternates AB/BA order, verifies stored results and saves cycle times and process CPU. Two completed local 20-pair comparisons are checked in under docs/benchmarks/results/: default text logging and the complete runtime changes. The complete comparison measured median wall times of 0.746001 s baseline and 0.752204 s candidate, with similar process CPU time; no speedup is claimed. Raw samples, full-precision summaries, configuration hashes, source/binary identities and toolchain records are checked independently in CI.

Validation completed locally: native macOS 17 suites passed with two expected skips; Linux ASan/UBSan 20 suites passed with two expected skips; real certificate trust/identity/protocol/cipher/plaintext boundaries passed with native Connector/C 3.4.11; real child resource limits and deferred/asynchronous cancellation passed; eight benchmark evidence tests and workflow/script checks passed. Fedora GCC 16 and Clang 22 each passed 21 suites with one expected skip. Full live mixed MariaDB/MySQL and SNMP coverage passed: 90.3% lines, 99.5% functions and 71.8% branches, with 100% line/branch coverage for the new ownership modules. Coverage also passed after reproducing pre-existing Automake logs to verify the source-evidence fix. GitHub CI adds separate MariaDB/MySQL client lanes.

Refs #568. Refs #590. Refs #547.
Refs #609, #476, #496, #571, #572 and #210.

docs/operations/issue-boundaries.md records remaining acceptance work: Cacti schema/UI integration, an SNMP provisioning contract, AIX/Solaris execution evidence, a post-merge scheduled nightly run, the broader ownership audit and poller-wide fatal/signal subprocess shutdown. These are not marked complete by the new per-call tests.

Stack base: refactor/c17-series-14-build-ci (#651). This PR must follow that predecessor; the repository's squash-only merge policy still requires restacking after each squash merge.