feat(storage): scaffold Caliber.Webhooks.EntityFrameworkCore (DbContext + schema) (S1 of #37)

[williamdewitt]

What

Foundation for the durable SQLite store — sub-task 1 of 3 for #37, under the M2 epic (#8). A new multi-target provider project, Caliber.Webhooks.EntityFrameworkCore, maps the M1 domain (WebhookMessage/Endpoint) to the messages/endpoints schema via EF Core and creates it with ensure-created. No store logic yet — no IMessageStore/IEndpointStore implementations (those are #46 and #47).

Highlights

• New project src/Caliber.Webhooks.EntityFrameworkCore (net8.0;net10.0), in the solution. The core package stays dependency-free — EF deps are isolated to the provider.
• Durable snake_case schema contract locked by a test: UNIQUE (event_id, endpoint_id) for idempotent fan-out, (status, next_attempt_at) for the due-message claim query, subscribed_event_types stored as JSON (null = subscribe-all).
• Schema-contract smoke test — creates the schema on a real SQLite file, asserts the column set and the unique index. The EF project is intentionally outside Stryker's scope (core-only) for now; mutation coverage of the store logic follows with feat(storage): EfMessageStore — SQL claim (UPDATE … RETURNING) + idempotent fan-out #46/feat(storage): EfEndpointStore + UseSqlite() opt-in + docs #47.

Dependency decisions (the non-obvious bits)

• EF Core Sqlite pinned to 8.0.28 via CPM — the net8 floor, same policy as the Extensions packages. Its transitive Microsoft.Extensions.* sit at 8.0.x, so CentralPackageTransitivePinningEnabled stays conflict-free. EF Core 10 would drag those transitives to 10.x and trip NU1109 against the 8.0.0 pins.
• Raised *.Abstractions floor to 8.0.2 — the graph's real transitive minimum (Http 8.0.0 → Logging 8.0.1 → *.Abstractions >= 8.0.2). The core project masked this by referencing them directly (authoritative); a provider that pulls them only transitively trips NU1109 without this.
• Pinned SQLitePCLRaw.bundle_e_sqlite3 to 2.1.11 and accepted CVE-2025-6965 (GHSA-2m69-gcr7-jv3q, High) via a documented, narrow NuGetAuditSuppress. It's a native-SQLite bug (< 3.50.2) with no fixed SQLitePCLRaw release, reachable only via attacker-controlled SQL — which this store never runs (EF-generated SQL, bound parameters only). Rationale + a "remove when upstream patches" trigger are in Directory.Build.props.

Verification

• dotnet build -c Release — green on net8.0 + net10.0, zero warnings (warnings-as-errors + Meziantou + analyzers).
• dotnet test — 155 passed on both TFMs.
• dotnet pack — .nupkg + .snupkg produced.

risk:core — for human review + merge.

Closes #45.