phoenix-sqlean

Bumping a bundled version

Pins live in packages/phoenix-sqlean/Makefile. Each has a partner that must move with it:

Pin	Moves with
`SQLITE_VERSION`	`SQLITE_RELEASE_YEAR` (the URL embeds both, so a mismatch 404s) and `SQLITE_SHA256`
`SQLEAN_COMMIT`	`SQLEAN_VERSION` in the `Makefile` and in `setup.py` — the commit is what gets fetched, the strings only describe it
`SQLEAN_VERSION`	`setup.py`'s copy, compiled in as what `sqlean_version()` returns. Suffix `+<short sha>` iff `SQLEAN_COMMIT` sits ahead of the named tag
`XXHASH_TAG`	`XXHASH_COMMIT` + `XXHASH_SHA256`, and the tag sqlean's own `Makefile` fetches

check-sqlean-pin, a prerequisite of download-sqlean, enforces the SQLEAN_* rows for one ls-remote: suffix prefixes the commit, base is a real tag, suffix present iff ahead, setup.py agrees. It cannot tell you the base names the wrong release — the single-commit fetch carries no ancestry. SQLITE_* and XXHASH_* get no equivalent cross-check — only their hashes, at fetch.