show-dependencies - #807

Description

Adds SHOW [EXTENDED] DEPENDENCIES [LIKE '<pattern>'] through the existing SHOW
analysis and structured-result paths.

• Generates and embeds a static, target-specific inventory from the StackQL
  binary's package graph during active native, cross-platform and Docker builds.
• Covers only the Go binary supply chain, not CI, Python, container or installed
  provider dependencies.
• Reconciles that dataset with immutable linker build information; development
  builds without enrichment retain linked modules with explicit missing metadata.
• Preserves effective replacements, exact versions, module checksums, pinned
  licence links, Package URLs and original identities.
• Adds case-insensitive %/_ filtering across effective name, original name
  and description, deterministic ordering and zero-row column metadata.
• Adds controlled-fixture unit tests and Robot coverage for default/extended
  results, with/without LIKE, escaping, nulls and PostgreSQL wire parity.

The issue's column table defines four default columns and ten extended columns,
despite its checklist saying five and eleven. The requester confirmed using
the explicitly named columns and their order.

The schema-only wire prerequisite is addressed in
stackql/psql-wire#19:
streams expose their column schema independently of rows, and zero-row results
complete normally without emitting EmptyQueryResponse.
StackQL preserves declared SHOW and native SQL column schemas, passes them at
stream construction, and no longer manufactures rows for empty results.
Dependency NULLs use the existing wire text encoder's typed nil-byte handling;
the companion PR does not change value encoding.
The companion PR is merged, and StackQL consumes its published tag
v0.1.3-beta01 (merge commit 8f98baf033ff89d06a457da188e66ff1e2becbb1).
Channel streams receive a ColumnProvider handle (the constructed result),
rather than a column slice, through a strictly unary constructor, and delegate
metadata access without consuming rows. The obsolete DataWriter.Empty API is removed;
actual empty-statement responses remain the protocol handlers' responsibility.

Type of change

• Bug fix (non-breaking change to fix a bug).
• Feature (non-breaking change to add functionality).
• Breaking change.
• Other (eg: documentation change). Please explain.

Issues referenced.

Closes #766.

Evidence

• CGO_ENABLED=0 go test -timeout 1200s ./... - passed.
• go test -timeout 120s ./internal/stackql/dependencies ./cicd/go/dependency-metadata - passed.
• go run ./cicd/go/dependency-metadata -targets linux/amd64,linux/arm64,darwin/amd64,darwin/arm64,windows/amd64 - passed.
• go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0 run --timeout 10m --new-from-rev origin/main
  with GOTOOLCHAIN=go1.25.3 - passed, zero new issues.
• python -m unittest discover -s cicd/python -p test_build.py - passed, two tests.
• python cicd/python/build.py --build - passed for Windows AMD64 and for
  GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 cross-compilation.
• python -m robot --variable "POSTGRES_URL_UNENCRYPTED_CONN:postgresql://test:test@127.0.0.1:55441/mydatabase?sslmode=disable" --outputdir <session-artifacts>/robot-dependencies-final test/robot/functional/stackql_dependencies.robot
  with the repository's test PYTHONPATH and a rebuilt local wire server - passed,
  eight tests after the schema-first revision, including unmatched SHOW SERVICES,
  an aliased zero-row SELECT, genuine dependency SQL NULLs and CLI/wire parity.
• Bare build without generated metadata: replacement identity, version, checksum
  and Package URL retained; missing attribution is UNKNOWN/NULL.
• Build CI run 37563172159
  • passed: supported platform builds, Windows ARM64 smoke, native/WSL Robot tests,
    Docker SQLite on AMD64/ARM64, all four PostgreSQL Robot shards, and shard verification.
• All 32 validation checks on tagged-release revision ac33b18 passed, including
  full Linux lint, CodeQL, GitGuardian and the OpenAI stdio smoke matrix.
  Local full Go tests, eight Robot scenarios and pinned changed-code lint also passed.
• Tagged-release revision ac33b18: go get github.com/stackql/psql-wire@v0.1.3-beta01
  and go mod tidy completed with no unrelated dependency changes.
  CGO_ENABLED=0 go test -timeout 120s ./internal/stackql/driver ./internal/stackql/psqlwire ./internal/stackql/util ./internal/stackql/data_staging/input_data_staging ./internal/stackql/primitivebuilder ./internal/stackql/intrinsic
  passed; native build, eight Robot scenarios and pinned changed-code lint passed.
  Fresh CI passed for the tag bump; the optional claude-code-action check was skipped.

Python commands above used the configured Python 3.13 executable at
C:\Users\javen\AppData\Local\Microsoft\WindowsApps\python3.13.exe;
Robot reports were written outside the repository in the session artifact directory.

Checklist:

• A full round of testing has been completed, and there are no test failures as a result of these changes.
• The changes are covered with functional and/or integration robot testing.
• The changes work on all supported platforms.
• Unit tests pass locally, as per the developer guide.
• Robot tests pass locally, as per the developer guide.
• Linter passes locally, as per the developer guide.

Variations

Focused Robot coverage was run locally; the full mock suite and PostgreSQL
backend matrix passed in CI. The local Windows full-lint command reports
20 pre-existing revive findings because path-based exclusions do not match
Windows separators. Changed-code lint passes with CI's pinned lint/toolchain
versions; full Linux CI lint passed.

GoReleaser is intentionally untouched because it is not an active release path.
The existing JSON renderer's empty-result representation remains null; CSV and
wire clients retain their normal result columns with zero data rows.

Tech Debt

No new technical debt. Unknown attribution stays explicit; the feature does not
claim deployment-SBOM completeness or automated legal compliance.