feat(slice): subsystem exclusion with cascade safety + contract extraction

[pyramation]

Summary

Downstream half of subsystem substitution (planning issue constructive-io/constructive-planning#1318, upstream primitive in constructive-io/pgsql-parser#322 → @pgsql/transform@18.7.0): a pure decision/verification engine in pgpm/slice that lets a consumer exclude a subsystem from imported SQL and prove the exclusion is safe before any rewrite happens.

excludeSubsystem(sql, { schemas: ['identity'] }, { rebinds?: SchemaRouter })
  → {
      excluded, kept,           // statement partition (schema-membership + GRANT targeting)
      contract: {
        provides,               // everything the subsystem creates
        required,               // subsystem objects survivors actually reference (with fk flag + dependents)
        internal                // unreferenced implementation detail — droppable silently
      },
      unsatisfied,              // kept references into the subsystem with NO rebind route — safe ⇔ empty
      warnings                  // mixed-statement | opaque-statement (COMMENT ON/bare DROP) | dynamic-sql
    }

Key behaviors:

• Contract extraction is measured, not declared: required is derived purely from the reference graph (references/bodyReferences/fkTargets per statement), so the replacement surface is exactly what the surviving SQL uses — e.g. one uuid-PK table (FK target) + one accessor function — while dozens of internal columns/tables/functions land in internal.
• Cascade safety: every surviving reference into the subsystem must resolve through the router (resolveObject, trying each object namespace since classifier refs are untagged; whole-schema routes count) or it lands in unsatisfied with the offending statement index. 18.7.0's name-rebind targets ({ schema, name }, schema: null = de-qualify) are what make "point identity.current_actor() at current_user_id()" expressible.
• No silent guessing: statements whose targets the classifier can't see (COMMENT ON, bare DROP) and kept EXECUTE bodies produce warnings instead of being classified.
• Pure and I/O-free: the actual removal/rewrite stays with the existing seams (transpileBundle.transformScript on the same router); this module only decides and checks.

Also bumps @pgpmjs/transform's upstream dep to @pgsql/transform@^18.7.0.

Tests: 8 new vendor-neutral cases in pgpm/slice/__tests__/exclude.test.ts; slice 4 suites / 48 tests and transform 31 tests green, tsc --noEmit clean.

Link to Devin session: https://app.devin.ai/sessions/025fb88043964fdbb335ac5e39df2478
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring