fix SQL injection

[kuaukutsu]

fix: parameterized queries in migration tracking table operations

Replace sprintf-interpolated SQL with named placeholders (:name, :version,
:atime) in INSERT/DELETE statements within Command::up() and Command::down().
Table name remains injected via sprintf but is now validated in Config
constructor against /^\w+$/.

Refactoring:

• Extract shared fetchRecord/exec logic into abstract Statement class;
  Transaction and TransactionMysql now extend it
• Add ThrowPrepareException trait with prepareException(PDO $connection): never
  to eliminate duplicated error-handling code between Connection and Statement
• Add ErrorInfo value object for consistent PDO::errorInfo() formatting
• Add PrepareException for prepare() failures
• Add FactoryTransaction interface; Type::makeFactoryTransaction() replaces
  the if/else branch in Connection::beginTransaction()

Bug fixes:

• generateVersion(): replace substr(..., 0, -1) with explicit substr(..., 0, 12)
• filesystem/Action::down(): use joinFilename() instead of string concatenation

Tests:

• StatementTest: parameterized exec/fetchRecord, SQL injection via bound params
• ConfigurationTest: valid and invalid table name cases