fix(m172): prove the thread read's cleanup, and green both verification lanes

The read-path work itself was already committed. This lands what verifying it
turned up.

Three defects in the implementation commit, all found by running the suites the
prior session counted but never ran:

- messages_list_integration_test.zig sent a bodiless PUT, which trips a std
  assert and aborted the whole runner, so zero integration tests executed.
- tenant_workspaces.zig emitted LIMIT before ORDER BY, which Postgres rejects
  outright: every variant of that statement 500'd. Its inner sort was also
  unqualified against a `t AS id` output alias, so it ordered text while the
  keyset compared uuid. Both fixed; all four variants now PREPARE clean.
- library_read_counters.zig still budgeted three statements after the merged
  authorization funnel cut it to two.

The chat view's dead fallback arms are gone structurally rather than by
deletion: ViewData is now a union tagged by view, so each loader takes the
shape its own view always carries and cannot carry a fallback for data it
cannot lack.

The thread read's cleanup is now proven, not read. readRow unwinds through a
fourteen-rung errdefer ladder that only runs when a later allocation fails, so
no ordinary test ever touched a rung; checkAllAllocationFailures fails each
allocation site in turn and asserts nothing leaked on the way out.

Two pre-existing defects blocked this milestone's own lanes and are fixed here
rather than deferred. Both are timing assumptions that hold on an idle machine;
this milestone's added tests lengthened the suite enough to expose them.

- patch_concurrent_integration_test.zig asserted a client wall clock for a
  timeout Postgres enforces server-side, guarded by a Linux-only tracer probe
  that never fired on macOS. kcov dilates the client, not the database. The
  holder now releases on a signal instead of a 7s timer, so the test asserts the
  ordering it always claimed — the 503 arrived while the lock was still held —
  and the platform branch is deleted.
- vitest.setup.ts carried testing-library's 1s async ceiling, which a Radix
  dialog exceeds under full-suite parallelism. Raised suite-wide; no assertion
  weakens.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>