deps: upgrade sea-orm to 2.0.2 stable and sqlx 0.9

[hardbyte]

Closes #443.

What

• sea-orm 2.0.0-rc.38 → 2.0.2 stable (pulls sea-query 1.0.0-rc.33 → 1.0.2), unifying sqlx for awa-seaorm consumers.
• sqlx 0.8.6 → 0.9.0 across the root workspace, awa-python, and examples/rust-app-demo.
• Feature-flag migration: sqlx 0.9 deleted the combined runtime+TLS features, so runtime-tokio-rustls → runtime-tokio + tls-rustls-ring (same ring provider + webpki roots as before).

The interesting part: sqlx 0.9's SqlSafeStr guard

Query functions now only accept &'static str or an explicit assertion, so dynamically assembled SQL must opt in (~700 sites here). Added audited_sql() — pub on awa-model, re-exported from the awa facade next to map_sqlx_error — whose doc comment records the audit invariant: interpolated content is limited to identifiers validated by validate_ident ([a-z0-9_]+) and fixed fragments; every external value travels as a bind parameter.

Two maintenance.rs rescue-sweep helpers also needed the wrapper because Query<'q> is now 'static over its SQL (E0521 otherwise).

No schema, migration, or behavioural changes; no compile-time macros / offline cache in this repo, so no .sqlx regeneration was needed.

Verification

• cargo fmt / cargo clippy --all-targets --all-features -D warnings / cargo build --workspace: green.
• Full workspace test suite against Postgres 17: 740 passed, 87 ignored, 1 failed — the failure is external_wait_test::test_e19_wait_for_callback_happy_path (state observed mid-transition under load; sibling test flaked identically pre-upgrade). Also reproduced-and-dismissed: an adapter_api_test failure caused by stale orphaned schemas in a shared dev database (fails identically on main), and lock-exhaustion failures from running unsharded against a stock container (CI shards migrations tests; local container now runs with max_locks_per_transaction=512).
• awa-python: maturin develop + pytest — 311 passed / 1 skipped. The 7 pool-timeout setup errors in test_start_config.py reproduce on main (16 passed / 8 errors there) — pre-existing connection accumulation in that file's fixture, not upgrade-caused.
• examples/rust-app-demo builds clean incl. clippy.
• A/B sanity check: the heavy single-migration-replay test runs ~3× faster on this branch than on main locally (66s vs 221s).

Follow-ups noticed en route (separate PRs): the python test_start_config.py connection leak above, and ~/dotfiles/scripts/update-cli-tools.py installing a Linux musl sccache binary on macOS (its arches map has no Darwin targets).

Summary by CodeRabbit

• Changed
  • Upgraded database integrations to improve SQL safety and compatibility.
  • Added safeguards for dynamically generated and caller-provided SQL.
  • Updated the Rust demo application for the latest database integration.
  • Expanded automated formatting and lint checks to cover the demo application.
• Documentation
  • Added unreleased changelog notes covering the database integration upgrades and SQL safety improvements.

[coderabbitai]

Warning

Review limit reached

Next included review available in 51 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 11581f32-4000-436f-ae31-266e36e20f07

📥 Commits

Reviewing files that changed from the base of the PR and between 001a46d and c8febf9.

⛔ Files ignored due to path filters (3)

• Cargo.lock is excluded by !**/*.lock
• awa-python/Cargo.lock is excluded by !**/*.lock
• examples/rust-app-demo/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (49)

• .github/workflows/ci.yml
• CHANGELOG.md
• Cargo.toml
• awa-cli/src/main.rs
• awa-cli/tests/migrate_cli_test.rs
• awa-cli/tests/storage_finalize_cli_test.rs
• awa-model/src/admin.rs
• awa-model/src/batch_operations.rs
• awa-model/src/dlq.rs
• awa-model/src/insert.rs
• awa-model/src/lib.rs
• awa-model/src/migrations.rs
• awa-model/src/queue_storage.rs
• awa-model/src/reschedule.rs
• awa-model/tests/heartbeat_write_removal_test.rs
• awa-model/tests/least_privilege_migration_test.rs
• awa-model/tests/queue_storage_copy_test.rs
• awa-model/tests/receipt_plane_fillfactor_test.rs
• awa-model/tests/sql_only_storage_upgrade_test.rs
• awa-python/Cargo.toml
• awa-python/src/client.rs
• awa-python/src/transaction.rs
• awa-seaorm/tests/seaorm.rs
• awa-testing/src/lib.rs
• awa-testing/src/setup.rs
• awa-worker/src/client.rs
• awa-worker/src/completion.rs
• awa-worker/src/maintenance.rs
• awa/src/lib.rs
• awa/tests/benchmark_test.rs
• awa/tests/chaos_suite_test.rs
• awa/tests/lifecycle_hook_test.rs
• awa/tests/migration_test.rs
• awa/tests/postgres_failover_smoke_test.rs
• awa/tests/progress_test.rs
• awa/tests/queue_storage_benchmark_test.rs
• awa/tests/queue_storage_runtime_test.rs
• awa/tests/queue_storage_soak_test.rs
• awa/tests/receipt_plane_chaos_test.rs
• awa/tests/receipt_plane_regression_gate.rs
• awa/tests/retention_test.rs
• awa/tests/rolling_transition_rehearsal_test.rs
• awa/tests/rolling_upgrade_rehearsal_test.rs
• awa/tests/scale_test.rs
• awa/tests/telemetry_test.rs
• awa/tests/validation_test.rs
• examples/rust-app-demo/Cargo.toml
• examples/rust-app-demo/src/bin/seed_demo.rs
• examples/rust-app-demo/src/shared.rs

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}