VACUUM snapshot metadata through the sqlite driver, not a CLI (closes #120)

snapshot create vacuumed the exported metadata database by shelling out
to a sqlite3 binary, so a backup failed at the very end on any host
without that CLI. vacuumDatabase now opens the database with the
modernc.org/sqlite driver and runs VACUUM through it, outside any
transaction; internal/snapshot no longer imports os/exec. The database
opens in WAL mode, so the close after VACUUM checkpoints the rewrite
into the main file that is compressed and uploaded. A new test deletes
marked rows, vacuums, and asserts the file shrank and no longer holds
the deleted bytes. script/bootstrap and the Dockerfile stop installing
the CLI in both the test-build and the shipped runtime stage, so the
image no longer carries the dependency this change removes.

Model: opus-4-8

internal/snapshot/snapshot_test.go

@@ -2,6 +2,7 @@
 package snapshot
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"io"
@@ -96,6 +97,97 @@ func verifyCleanedDB(
 	}
 }
 
+// TestVacuumDatabaseRemovesDeletedData proves the export path uploads a
+// compacted database: after rows carrying a recognizable marker are deleted
+// and vacuumDatabase runs, no page holding that marker survives in the file
+// on disk (the file compressFile later reads for upload).
+func TestVacuumDatabaseRemovesDeletedData(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	ctx := context.Background()
+	fs := afero.NewOsFs()
+
+	tempDir := t.TempDir()
+	dbPath := filepath.Join(tempDir, "snapshot.db")
+
+	db, err := database.New(ctx, dbPath)
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+
+	// A marker distinctive enough that its presence in the raw file can only
+	// come from the rows inserted below.
+	marker := []byte("VACUUM_PROBE_DEADBEEF_DELETED_ROW")
+	payload := bytes.Repeat(marker, 128) // ~4 KiB per row
+
+	_, err = db.Conn().ExecContext(ctx,
+		"CREATE TABLE vacuum_probe (id INTEGER PRIMARY KEY, payload BLOB)")
+	if err != nil {
+		t.Fatalf("failed to create probe table: %v", err)
+	}
+
+	for range 512 {
+		_, err = db.Conn().ExecContext(ctx,
+			"INSERT INTO vacuum_probe (payload) VALUES (?)", payload)
+		if err != nil {
+			t.Fatalf("failed to insert probe row: %v", err)
+		}
+	}
+
+	_, err = db.Conn().ExecContext(ctx, "DELETE FROM vacuum_probe")
+	if err != nil {
+		t.Fatalf("failed to delete probe rows: %v", err)
+	}
+
+	// Close so the deletes reach the main file, mirroring the state
+	// prepareExportDB hands to vacuumDatabase.
+	err = db.Close()
+	if err != nil {
+		t.Fatalf("failed to close database: %v", err)
+	}
+
+	beforeInfo, err := fs.Stat(dbPath)
+	if err != nil {
+		t.Fatalf("failed to stat database before vacuum: %v", err)
+	}
+
+	beforeBytes, err := afero.ReadFile(fs, dbPath)
+	if err != nil {
+		t.Fatalf("failed to read database before vacuum: %v", err)
+	}
+
+	if !bytes.Contains(beforeBytes, marker) {
+		t.Fatalf("expected deleted-row data to linger before vacuum")
+	}
+
+	sm := &SnapshotManager{fs: fs}
+
+	err = sm.vacuumDatabase(ctx, dbPath)
+	if err != nil {
+		t.Fatalf("vacuumDatabase failed: %v", err)
+	}
+
+	afterBytes, err := afero.ReadFile(fs, dbPath)
+	if err != nil {
+		t.Fatalf("failed to read database after vacuum: %v", err)
+	}
+
+	if bytes.Contains(afterBytes, marker) {
+		t.Fatalf("deleted-row data survived vacuum in the uploaded file")
+	}
+
+	afterInfo, err := fs.Stat(dbPath)
+	if err != nil {
+		t.Fatalf("failed to stat database after vacuum: %v", err)
+	}
+
+	if afterInfo.Size() >= beforeInfo.Size() {
+		t.Fatalf("expected vacuum to shrink the file: before=%d after=%d",
+			beforeInfo.Size(), afterInfo.Size())
+	}
+}
+
 func TestCleanSnapshotDBEmptySnapshot(t *testing.T) {
 	// Initialize logger
 	log.Initialize(log.Config{})