cut: schema gate — refuse to release an undisclosed querylog schema change

the gate recomputes the previous release tag's ddl fingerprint from the
remote peeled object and compares it against the tree's; a change must
be disclosed by 'resets your query history' in the version's changelog
section. the 0.0.9 reset shipped with an announcement claiming no
schema change; this makes the impact mechanical instead of remembered.

build.zig

@@ -275,7 +275,21 @@ pub fn build(b: *std.Build) void {
     // needs the operator's terminal so `git commit -S` can reach pinentry —
     // none of which a workflow supplies and all of which a Run step passes
     // through.
+    // The cut's schema gate compares the querylog fingerprint of the previous
+    // release against this tree's. It must read that number from the file the
+    // server uses, never from a copy: a duplicated DDL or a duplicated hash
+    // would let the gate pass a schema change it no longer describes. Only
+    // `fingerprint` and `fingerprintOf` are referenced, both of which are
+    // comptime-computable text hashing, so no SQLite symbol is pulled in and
+    // the host tool needs no library.
+    const querylog_schema_mod = b.createModule(.{
+        .root_source_file = b.path("src/storage/querylog_schema.zig"),
+        .target = b.graph.host,
+        .optimize = optimize,
+    });
+
     const cut_tool = hostTool(b, "cut");
+    cut_tool.root_module.addImport("querylog_schema", querylog_schema_mod);
     const cut_run = b.addRunArtifact(cut_tool);
     // It pushes commits and tags, so it must never be answered from the run
     // cache, and it must run at the build root whatever directory `zig build`
@@ -298,7 +312,12 @@ pub fn build(b: *std.Build) void {
             .optimize = optimize,
         }),
     });
-    test_step.dependOn(&b.addRunArtifact(cut_tests).step);
+    cut_tests.root_module.addImport("querylog_schema", querylog_schema_mod);
+    const cut_tests_run = b.addRunArtifact(cut_tests);
+    // The schema-gate round trip reads `src/storage/querylog_schema.zig` off
+    // disk, so the test binary has to run at the build root.
+    cut_tests_run.setCwd(b.path("."));
+    test_step.dependOn(&cut_tests_run.step);
 
     addDist(b, options, admin_assets, .{
         .version = version_option,