VERSION: refresh stale comment (triggers re-vendor workflow)

The hash is pinned (no longer a placeholder); clarify that fetch-sqlite.sh
verifies against it and the Vendor workflow re-commits sqlite3.c on a bump.

https://claude.ai/code/session_01AdvNtQ7wCMVy8etacVQbjg

Author: claude

Sources/CSQLite/VERSION

@@ -9,6 +9,8 @@ SQLITE_AMALGAMATION=sqlite-amalgamation-3470200
 SQLITE_YEAR=2024
 # Official SHA3-256 of the amalgamation .zip, copied verbatim from the
 # "Source Code" table on https://www.sqlite.org/download.html.
-# fetch-sqlite.sh FAILS CLOSED while this is the placeholder unless
-# SQLITE_ALLOW_UNPINNED=1 is exported — never relax that in CI.
+# fetch-sqlite.sh verifies every download against this hash (fail-closed on a
+# mismatch). On a version bump, update all four fields together; the
+# "Vendor SQLite amalgamation" workflow then re-fetches and re-commits the
+# sqlite3.c / sqlite3.h sources.
 SQLITE_SHA3_256=0e4df2263ef8169f9396b9535d9654d8d64ae8eb1a339ba06c7b12a72e6fb020