fix(storage): accept verified native SQLite descriptor reuse

[drewstone]

A second in-process Setup save could fail with STORAGE_PATH_RACE: the SQLite Unix VFS reused an earlier verified descriptor to preserve POSIX locks, so it made no new open call. The Linux-only fallback now accepts reuse only from the maintained native cipher factory, with a live previously verified same-inode descriptor and an open database naming the validated file. Injected factories still fail closed. A WAL three-open regression was red before this fix and green after it; the compiled CLI now passes A→B→A at 120×40 and 80×24 with distinct credentials, save/reopen, encrypted reload, and authenticated preflight through final A. Full pnpm check passed on GTR. Loopback 503 means no live cloud task completed; package publication remains held pending protected live evidence.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[tangletools]

✅ Auto-approved PR — 7236d4ea

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-09-29T10:33:11Z}