fix(consolidate): floor NULL demote target instead of nulling importance (#188)

[edheltzel]

Summary

Hardens the consolidate child re-clamp to deliver the floor-of-1 invariant its comment advertised, from the RedTeam gate on PR #184 (issue #145).

The demote re-clamp used MAX(1, MIN(importance, CAST(? AS INTEGER))). A NULL importance payload wrote NULL (CAST(NULL)→NULL, MIN/MAX with NULL→NULL), so the comment's claim that the floor of 1 is re-pinned "regardless of the supplied value" was overstated. Not reachable on the legit path (the planner always supplies an integer) and not a regression (pre-PR SET importance = ? nulled identically) — but it didn't fully deliver the asterisked invariant.

Changes

1. SQL — wrap the bind in COALESCE(?, importance): MAX(1, MIN(CAST(COALESCE(?, importance) AS INTEGER), importance)). A NULL payload now no-ops to the current value and MAX(1, …) re-pins the floor for every input, NULL included. The "can only LOWER, never raise" guarantee is unchanged.
2. Comment — tightened to state the real guarantee (NULL → no-op, floor honored for all inputs).
3. Tests
   • NULL-floor: a NULL newImportance no-ops to the current value and never nulls the column (tests/hooks/consolidate-core.test.ts).
   • End-to-end spawn → err.stderr → parse link (the LOW from the same gate): a child emits a RECALL_CONSOLIDATE_PROGRESS marker then hangs past a short execSync timeout; the SIGTERM'd child's captured stderr is recovered by parseConsolidateProgress (tests/lib/consolidate.test.ts). Prior coverage proved the parser and the apply separately but never the live link.

Verification

• bun run lint clean.
• bun test — full suite 1191 pass / 0 fail (in-worktree, with node_modules resolvable). The 19 consolidate tests (incl. the two new ones) pass.

risk:low — defense-in-depth hardening on a non-reachable path; the legit planner path is unaffected.

Closes #188