chore: prepare 0.2.4 with PostgreSQL lock-safety fix - #31

Summary

• Prepare duroxide 0.2.4 and all five matching native packages.
• Require the crates.io duroxide-pg 0.1.38 release containing fix: make orchestration lock renewal and acknowledge safe under concurrency duroxide-pg#44.
• Document migration 0026, its write-blocking index build, and the database rollback constraint.
• Keep the JavaScript API, Rust wrapper code, runtime crate version and CI gates unchanged.

Release dependency

Draft: blocked by microsoft/duroxide-pg#50 and publication of the 0.1.38 crate.

The provider release PR does not publish the crate. A maintainer must complete
that separate release process before this branch can pass its registry-only
builds. Do not merge or publish this native release until the crate is available
and the existing cross-platform builds, SDK tests and package smoke checks pass.

There are no local source patches, Git dependency overrides, replacement
binaries or invented package checksums in this PR.

Validation

• Passed: all six package versions and all five optional native pins agree.
• Passed: generated lockfile root matches the manifest; existing tool dependencies are unchanged.
• Passed: npm pack --dry-run --ignore-scripts and git diff --check.
• Blocked: Linux cargo metadata --format-version 1, using repository toolchain
  Rust 1.97.1, cannot resolve duroxide-pg = "^0.1.38" because crates.io still
  publishes 0.1.37 as the latest version.
• Native builds, SDK regression tests and cross-platform package smoke checks
  remain required. No runtime qualification is claimed.

Upgrade and publication notes

Connecting to PostgreSQL applies migration 0026. Its unique index on
instance_locks(lock_token) is not built concurrently. Qualify write interruption,
mixed-version operation and rollback before a production rollout. An older
native build can reject an unknown applied migration; reinstalling its npm
package does not undo the database migration.

The fix addresses renewal/fetch/acknowledge/abandon races. It does not claim to
resolve the separate fetch-vs-fetch deadlock in microsoft/duroxide-pg#34.

Python parity was checked: duroxide-python still declares provider 0.1.37.
This PR has no wrapper, handler or public API changes. Its dependency adoption
must be coordinated separately for Python.

After merge and successful qualification, a Microsoft maintainer publishes the
six npm packages through the existing internal release process. This PR does
not publish packages or create a GitHub Release.