feat: add v0.5.0 trust and stability hardening

[emremy]

Summary

This PR implements the v0.5.0 Trust & Stability Hardening release for ColQL.

The focus is not feature expansion, but improving correctness confidence, API stability, serialization safety, and performance predictability before moving closer to v1.0.0.

What changed

Type/API stability

• Added a dedicated test:types gate.
• Added tsconfig.type-tests.json.
• Wired type tests into CI.
• Added/kept type coverage for query, mutation, index, explain, and onQuery APIs.

Column-scoped index invalidation

• Updates now dirty only indexes whose indexed columns actually changed.
• Non-indexed column updates no longer dirty unrelated equality/sorted/unique indexes.
• Equality indexes now track dirty columns instead of relying on one broad global dirty flag.
• Sorted indexes are dirtied only when their column changes.
• Deletes still dirty row-position-sensitive indexes broadly for correctness.

Serialization hardening

• Introduced a numeric wire-format version independent from package version.
• Hardened serialized metadata and payload validation.
• Added validation for duplicate columns, rowCount/capacity relations, offsets, alignment, byte ranges, overlap, dictionary metadata, invalid dictionary codes, and serialized index metadata.
• Rejected serialized indexes explicitly.
• Wrapped restore-time reconstruction failures as COLQL_INVALID_SERIALIZED_DATA.
• Added corruption coverage for NaN, Infinity, and -Infinity numeric payloads.

Correctness testing

• Added deterministic mutation/index/serialization fuzzer.
• The fuzzer uses a JS array oracle and covers insert/update/delete/updateBy/deleteBy/serialize/restore/reindex/query parity.
• Added focused invalidation and serialization corruption tests.

Observability and diagnostics

• Added additive optional diagnostics fields to QueryInfo.
• Added selectedIndex to QueryExplainPlan.
• Kept explain() non-executing and non-rebuilding.
• Marked unstable diagnostic surfaces with @internal comments.

Benchmarks and docs

• Added CodSpeed benchmark cases for no-rebuild vs lazy-rebuild paths.
• Updated README/docs for:
  • v0.5 invalidation behavior
  • type-test gate
  • serialization compatibility policy
  • rejected serialized indexes
  • public diagnostics guidance
  • release benchmark protocol
  • process-local / non-durable / non-SQL positioning

Serialization compatibility note

v0.5.0 introduces a hardened serialization format with an independent numeric wire-format version.

Serialized snapshots created with v0.4.x are not guaranteed to be compatible with v0.5.0.

Serialized indexes remain unsupported and are rejected during restore.

Validation

• npm test — passed, 69 files / 238 tests
• npm run test:types — passed
• npm run build — passed
• npm run bench:codspeed — passed
• npm --cache /private/tmp/colql-npm-cache pack --dry-run — passed

Tarball contents confirmed:

• LICENSE
• README.md
• dist/index.d.mts
• dist/index.d.ts
• dist/index.js
• dist/index.mjs
• package.json

ColQL remains a process-local, in-memory query engine and is not positioned as a database replacement.

[codspeed-hq]

Merging this PR will improve performance by ×3.9

⚡ 2 improved benchmarks
✅ 18 untouched benchmarks
🆕 2 new benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	index/lazy-rebuild/after-indexed-column-mutation/10k	70.4 ms	18.1 ms	×3.9
🆕	index/requery/after-lazy-rebuild/10k	N/A	399.9 µs	N/A
🆕	index/no-rebuild/after-unindexed-column-mutation/10k	N/A	431.4 µs	N/A
⚡	mutation/updateWhere/subset/1k	7.5 ms	2.2 ms	×3.4

---

_{Comparing v0.5.0 (6c8ce99) with main (50001cd)}