refactor(driver): adopt stable redacted runtime error contracts

[charles-fineman]

Outcome

Public pgx and database/sql execution, scan, and transaction paths return stable redacted Grizzle errors without exposing raw SQL, bind values, statement names, credentials, or raw driver errors.

Context

Issue #447 establishes the error-returning build/render contract and normalizes build failures before database use. Its explicit scope excludes driver execution behavior unrelated to build errors. Agent review of #447 confirmed that post-build driver, scan, and transaction failures still use raw or ad hoc errors, so that work is tracked separately here.

In scope

• Normalize pgx and database/sql Query/Exec and trusted raw execution failures.
• Normalize prepared-handle execution failures after successful build/validation.
• Implement stable scan/cardinality/invalid-row errors and row ownership rules.
• Implement stable transaction begin/commit/rollback/callback errors.
• Complete nil and typed-nil receiver/rows checks at public driver boundaries.
• Preserve context.Canceled and context.DeadlineExceeded through errors.Is without exposing raw causes.
• Add cross-driver redaction and conformance tests.

Out of scope

• Build/RenderSQL signature changes completed by refactor(query): adopt error-returning build and render contracts #447.
• Runtime prepared parameter plans tracked by feat(query): build reusable typed prepared plans #440.
• Compatibility shims or migration support for older APIs.

Acceptance criteria

• Runtime driver errors are mapped to stable Grizzle error codes with redacted diagnostics.
• Raw SQL, values, identifiers, statement names, credentials, and raw driver errors are not recoverable through Error, Unwrap, logs, or %+v.
• Context cancellation/deadline sentinels remain discoverable with errors.Is.
• Scan helpers enforce documented row ownership and cardinality behavior.
• Transaction helpers expose stable begin/commit/rollback/callback classifications.
• pgx and database/sql conformance tests cover nil/typed-nil inputs and redaction.

Related: #447