refactor(vnext): share bounded SQL lexical primitives

## Summary

- extract dialect lexical profiles and shared UTF-16 identifier, quote,
block-comment, and dollar-quote scanners from the statement index
- preserve statement-index behavior while adding explicit upper bounds
needed by the parser-independent query-site recognizer
- make bounded dollar-quote opener/closer classification
prefix-deterministic and keep partial close search bounded
- add direct boundary regressions for quotes, block comments, dollar
quotes, UTF-16 identifiers, and SQL whitespace

This is a private prerequisite for ADR 0005 step 3; it adds no public
package export.

## Validation

- `pnpm run typecheck` (strict and loose optional-property modes)
- `pnpm exec oxlint`
- `pnpm run test:integrity`
- 1,272 Node tests passed + 1 expected failure
- 7 Chromium tests passed
- packed-package smoke passed
- worker-placement/runtime evidence passed
- demo build passed
- changed coverage: 98.51% statements, 96.75% branches, 100% functions,
98.50% lines
- three independent exact-head adversarial approvals at `652b108`

## Review history

Adversarial review found a dollar-opener read beyond an explicit scan
limit. The final head guards the opener before inspecting a suffix and
includes bounded-prefix equivalence coverage. No additional Copilot
request will be made after the one request for this PR.

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Shares SQL lexical primitives and adds explicit scan limits to prevent
over-reads while keeping statement-index behavior. Also preserves fast,
bounded ASCII word scans and fixes dollar-quote opener detection.

- **Refactors**
- Moved scanners for quotes, block comments, dollar quotes, UTF‑16
identifiers, and SQL whitespace into `src/vnext/lexical.ts` with
explicit `limit` handling; preserved fast ASCII word scanning in
`statement-index.ts` for performance.
- Centralized dialect profiles and helpers; `statement-index.ts` now
imports these and drops duplicate logic.

- **Bug Fixes**
- Dollar-quote opener classification is now prefix-bounded; no suffix
reads beyond the scan limit.
- Quote and block comment scanners respect limits, including line-break
and backslash cases.
- Dollar-quote tags over 256 chars return `delimiterTooLong` instead of
scanning unbounded.

<sup>Written for commit 3600269.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/marimo-team/codemirror-sql/pull/185?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

Author: Light2Dark

src/vnext/__tests__/lexical.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, it } from "vitest";
+import {
+  isSqlWhitespace,
+  scanSqlBlockComment,
+  scanSqlDollarQuote,
+  scanSqlQuoted,
+  sqlIdentifierContinueLengthAt,
+  sqlIdentifierStartLengthAt,
+} from "../lexical.js";
+
+describe("shared SQL lexical primitives", () => {
+  it("uses UTF-16 identifier lengths without splitting valid pairs", () => {
+    expect(sqlIdentifierStartLengthAt("a", 0)).toBe(1);
+    expect(sqlIdentifierContinueLengthAt("1", 0)).toBe(1);
+    expect(sqlIdentifierStartLengthAt("😀", 0)).toBe(2);
+    expect(sqlIdentifierContinueLengthAt("\uD800", 0)).toBe(1);
+    expect(sqlIdentifierStartLengthAt("1", 0)).toBe(0);
+  });
+
+  it("recognizes only the SQL whitespace set", () => {
+    for (const code of [9, 10, 11, 12, 13, 32]) {
+      expect(isSqlWhitespace(code)).toBe(true);
+    }
+    expect(isSqlWhitespace(0xa0)).toBe(false);
+  });
+
+  it("never scans a quote beyond its explicit limit", () => {
+    expect(scanSqlQuoted("'abc'x", 0, 4, 39, 1, false, true, false)).toEqual({
+      closed: false,
+      to: 4,
+    });
+    expect(scanSqlQuoted("'abc'x", 0, 5, 39, 1, false, true, false)).toEqual({
+      closed: true,
+      to: 5,
+    });
+    expect(scanSqlQuoted("'a\nfar away", 0, 4, 39, 1, false, true, true)).toEqual({
+      closed: false,
+      to: 4,
+    });
+    expect(scanSqlQuoted("'\\\nfar away", 0, 4, 39, 1, true, true, true)).toEqual({
+      closed: false,
+      to: 4,
+    });
+  });
+
+  it("never scans a block comment beyond its explicit limit", () => {
+    expect(scanSqlBlockComment("/*x*/y", 0, 4, false)).toEqual({
+      closed: false,
+      to: 4,
+    });
+    expect(scanSqlBlockComment("/*x*/y", 0, 5, false)).toEqual({
+      closed: true,
+      to: 5,
+    });
+  });
+
+  it("never accepts a dollar-quote close beyond its explicit limit", () => {
+    expect(scanSqlDollarQuote("$$x$$y", 0, 4)).toEqual({
+      closed: false,
+      delimiterTooLong: false,
+      to: 4,
+    });
+    expect(scanSqlDollarQuote("$$x$$y", 0, 5)).toEqual({
+      closed: true,
+      delimiterTooLong: false,
+      to: 5,
+    });
+    expect(scanSqlDollarQuote("$tag$x$tag$far$tag$", 0, 10)).toEqual({
+      closed: false,
+      delimiterTooLong: false,
+      to: 10,
+    });
+  });
+
+  it("classifies dollar-quote openers only from the bounded prefix", () => {
+    for (const text of ["$", "$$", "$x"]) {
+      expect(scanSqlDollarQuote(text, 0, 1)).toBeNull();
+    }
+  });
+});