v0.46.3

Writable tables, transaction hooks and ATTACH options for the main catalog (docs).

• Writable catalog tables: CatalogTable.Builder#insertFunction/updateFunction/deleteFunction/writeResultMode; TableInfo advertises them and catalog_table_{insert,update,delete}_function_get now answer. New farm.query.vgi.write package: WriteOptions, WriteResultMode, WriteOperation, WriteResults (rowIdField, resultSchema, resultBatch, ...).
• Constraint enforcement: a writable table with constraint records negotiates vgi.constraint.enforce.v1 automatically; a provider advertising enforce without records-read is no longer dropped.
• Worker.onAttach(AttachHook) returns AttachSettings (per-attach supports_transactions / supports_time_travel); Worker.supportsTransactions(boolean) / supportsTimeTravel(boolean) set the worker-wide defaults (still true).
• Worker.transactionHooks(TransactionHooks): begin mints the plaintext transaction id; commit (throw to fail COMMIT) and rollback get the same bytes on every transport, HTTP included. CatalogInterface gains the same hooks.
• Functions get transactionId() and attachOptions() (AttachOptions, secret options included) on table and table in-out bind/init params; TableInOutInitParams also gets attachId() and bindOpaqueData().
• Secret ATTACH options reach functions: they are encrypted into attach_opaque_data (configured signing key, else HTTP sealing key, else a per-user host key file shared by pooled/stdio processes), never plaintext.
• The main catalog's resolved data version now survives on a process that never served the ATTACH.
• FunctionMetadata.withStability, Schemas.serialize; TransactionStorage docs corrected.
• txfix fixture worker; CI runs the vgi writable_tx suite (vgi c4a9fea) on launch, shm and http.