VACUUM snapshot metadata through the sqlite driver, not a CLI (closes #120)

snapshot create compacted the metadata database by running a sqlite3 command-line binary, after every blob had already been uploaded. On a host without that binary, which includes anyone who installed with go install, the backup failed at the last step, and two tests failed the same way.

VACUUM now runs through the Go sqlite driver the program already uses, and its error is returned to the caller. The runtime Docker image no longer installs the sqlite package, since nothing in the binary calls it.

model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)

internal/snapshot/snapshot.go

@@ -44,7 +44,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"time"
@@ -669,14 +668,31 @@ func (sm *SnapshotManager) collectCleanupStats(
 
 // vacuumDatabase runs VACUUM on the database to remove deleted data and compact
 // This is critical for security - ensures no stale/deleted data pages are uploaded
+//
+// VACUUM runs through the modernc.org/sqlite driver, on a freshly opened
+// connection with no transaction in flight (VACUUM cannot run inside one).
+// The database opens in WAL mode, so VACUUM's rewrite lands in the WAL; the
+// checkpoint on Close flushes it into the main file, which is the file we
+// then compress and upload.
 func (sm *SnapshotManager) vacuumDatabase(ctx context.Context, dbPath string) error {
 	log.Debug("Running VACUUM on database", "path", dbPath)
-	//nolint:gosec // G204: fixed argv; dbPath is our own temp file path
-	cmd := exec.CommandContext(ctx, "sqlite3", dbPath, "VACUUM;")
 
-	output, err := cmd.CombinedOutput()
+	db, err := database.New(ctx, dbPath)
 	if err != nil {
-		return fmt.Errorf("running VACUUM: %w (output: %s)", err, string(output))
+		return fmt.Errorf("opening database for VACUUM: %w", err)
+	}
+
+	defer func() {
+		cerr := db.Close()
+		if cerr != nil {
+			log.Debug("Failed to close database after VACUUM",
+				"path", dbPath, "error", cerr)
+		}
+	}()
+
+	_, err = db.ExecWithLog(ctx, "VACUUM")
+	if err != nil {
+		return fmt.Errorf("running VACUUM: %w", err)
 	}
 
 	return nil