Fix #90–#93: guarded SQL backups and apply diagnostics

[mira-voss]

Summary

• Fixes [sql] Row-scoped UPDATE can persist a full-table credential snapshot #90: use narrow row before-images where possible; block row-filtered mutations that would require a full-table snapshot unless --allow-full-table-backup is explicit. Dry-run and JSON output show backup scope and reason.
• Fixes [apply] Diagnose unwritable target directories before atomic replacement #91: diagnose unwritable apply parent directories before creating backup/temp artifacts, with parent_directory_not_writable and a conditional --sudo hint.
• Fixes [run] Document --sudo for script payloads in per-verb help #92: clarify in run help and scripting docs how --sudo applies to the selected script interpreter versus nested sudo commands.
• Fixes [sql] Accept --target as a host selector like other execution verbs #93: make SQL --target=<name> an alias for -h/--host and update help/tests.
• Adds v0.19.0 changelog notes and updates the supported-version policy.

Validation

• make check
• golangci-lint v2.13.2: run ./... --timeout=5m
• go build -o /tmp/sshx-release-check ./cmd/sshx