Add native literal substring query predicates

Implement checked containsInsensitive string predicates in GraphQL, protobuf,
native SQL and bounded residual evaluation. ASCII folding is deterministic;
SQL pattern characters remain literal. Retain deferred full-text index design.

Studio migration awaits a decision on checked native getter forwarding across
conformances; do not duplicate titles or bypass private state ownership.
Compiler and local full-stack substring-query acceptance pass.

test/fixtures/query-workspace.ts

@@ -76,7 +76,7 @@ export async function queryWorkspaceFixture(options: { live?: boolean } = {}) {
   const pkg: PackageRevision = pkgResult.resource.revision;
   const allInterfaces = [...interfaces.values(), ...(pkgResult.resource.specializations ?? [])];
   const documents: Record<string, string> = {
-    "extent.graphql": `query Extent {root {objects(first: 30, orderBy: [{rank: ASC}]) {entries {node {_qx {ref} title rank}}}}}`,
+    "extent.graphql": `query Extent($text: String! = "") {root {objects(first: 30, where: {title: {containsInsensitive: $text}}, orderBy: [{rank: ASC}]) {entries {node {_qx {ref} title rank}}}}}`,
     "upcoming.graphql": `query Upcoming($first: Int!, $after: Cursor) {root {items(first: $first, after: $after, where: {done: {eq: false}}, orderBy: [{rank: ASC}]) {entries {key cursor node {_qx {ref} ...TaskRow}} pageInfo {hasNextPage endCursor}}}}`,
     "row.graphql": `fragment TaskRow on TaskFacts {title rank done assignee {name}}`,
     "enriched.graphql": `query Enriched {root {items(first: 3) {entries {key node {_qx {ref} title score}}}}}`,

test/query-compiler.test.ts

@@ -276,6 +276,10 @@ test("fixed GraphQL yields exact effects, typed references and distinct query ar
 test("query allowlist and two-sided RPC effects fail during compilation", async () => {
   const rejects = (promise: Promise<unknown>, code: string) =>
     assert.rejects(promise, (error: unknown) => error instanceof QueryCompileError && error.code === code);
+  const substring = (field: string) =>
+    `query Upcoming {root {items(first: 3, where: {${field}: {containsInsensitive: "TASK"}}) {entries {node {...Row}}}}}`;
+  await compile(substring("title"));
+  await rejects(compile(substring("due")), "QUERY_VALIDATION");
   await rejects(compile(document, "fragment Row on TaskFacts { hidden }"), "QUERY_VALIDATION");
   await rejects(compile(document, "fragment Row on TaskFacts { score }"), "QUERY_RPC_CONSUMER_REASON");
   await compile(