fix(deps): adopt reviewed releases and invalidate stale Sparkle cache

[johnny4young]

Summary

• Update SQLCipher.swift 4.17.0 → 4.19.0 and KeyboardShortcuts 3.0.1 → 3.1.0 in the canonical locks, within existing manifest requirements. Tags were peeled to immutable commits and their manifests verified; no GRDB fork rebase or schema change.
• Update Sparkle 2.9.6 → 2.10.0 using the official tarball SHA-256. Fix a real cache bug: an existing framework previously bypassed the download even after a pin change. Require a matching version/checksum receipt and complete tools, and retain the previous installation on verification/incomplete-archive failure.
• Add eight offline fetch regressions to CI and extend the encryption migration test to quoted directory paths and reopening after export. Document upstream compatibility, risk assessment, and remaining gates.

Evidence

• SQLCipher advisory: two low-risk upstream issues. Reviewed Gancho paths use a fixed export alias and usePassphrase, not hexkey URI input; this does not establish an exploitable vulnerability in Gancho.
• SQLCipher tag 4.19.0 → commit 39f212458aeb88e33bdac2200a793a3f0d55d32b (Swift 6.0, macOS 10.13/iOS 12).
• KeyboardShortcuts changes: tag 3.1.0 → 772133d9dbe800fdac0473226822994c5c162c58 (Swift 6.2/macOS 10.15). Stored names/key codes remain unchanged; menu and recorder lifecycle need signed UI checks.
• Sparkle 2.10.0: macOS 12 floor fits Gancho 15.4; official tarball digest c2bf58aa8387266ac179357b1415d6f2635f044da8be41042af32425dae6da0c.

Validation

• PASS locally: eight offline Sparkle fetch cases, shell syntax, lock graph coherence/exact revisions, canary pin coherence with fixture, whitespace check.
• The fetch regression fails against the original script because it reuses an unmarked old cache without downloading.
• Local make format, make lint, and make test could not execute: this Linux environment has no Swift/Xcode. Locks were verified against upstream tags/manifests, not regenerated locally. CI must consume both with automatic resolution disabled.
• PASS hosted CI run 38061245723 at exact head 8feb071ccc526e2c04169677ec5ffcc421a39161: formatting, SwiftLint, dependency coherence, eight Sparkle fetch regressions, 1,610 package tests in 252 suites, 84.6% package production-source coverage (80% floor), StoreKit tests, macOS and iOS builds, and the real Sparkle download/checksum. GitGuardian also passed. The scheduled-only beta canary was intentionally skipped.
• Initial CI caught a line-length formatting error in the added test; the follow-up commit fixes it without relaxing checks. Independent scoped review found no correctness/regression defect.

Required before merge (keep draft)

• Storage/search performance benchmarks.
• Signed build reopens an existing backed-up store made with the old SQLCipher version, preserving clips/blobs. New-version round trips alone are insufficient evidence.
• Signed direct-download DMG, re-signed Sparkle helpers, strict/deep codesign verification and updater smoke check.
• Signed shortcut restoration, recorder cancellation/switching and re-recording, conflict rejection, and function keys with menus open, including supported OS coverage.

No merge, release, deployment, or canary issue closure is included.