ci(preview): bisect invalid seed rows instead of replaying batches row-by-row (stage 3) - #1151

Why this PR exists

• Preview seed run fix: preserve verdict state and skip cancelled preview gates #1139 spent 318 seconds loading sampled production data.
• One constraint-violating row caused an entire approximately 900-row batch to fall back to one SQL statement per row.
• Five bad legacy rows could therefore create thousands of connection-pool round trips.
• The fallback caught broad DBAPIError exceptions, so a dead connection, timeout, or serialization failure could be mislabeled as "bad data" and silently skipped.

Evidence

• Old behavior for one invalid row in a 1,000-row batch: one failed batch plus 1,000 row retries.
• New divide-and-conquer bound for one invalid row: at most 2 × ceil(log2(n)) + 1 probes.
• End-to-end smoke test sampled 36 rows, isolated a real unique-constraint collision, completed in approximately 0.5 seconds, and emitted the report.
• Migration-before-seed correctness is already enforced elsewhere by the preview bootstrap fingerprint and orchestration tests; this PR does not duplicate that work.

What this PR changes

• Replaces row-by-row fallback with recursive batch bisection.
• Rolls back only the failed savepoint, splits the batch, and recurses only into failing halves.
• Splits only IntegrityError / SQLSTATE class 23 failures.
• Lets network, timeout, deadlock, and serialization errors fail the seed loudly.
• Reports attempted batches, splits, skipped rows, SQLSTATE/constraint causes, stable row identifiers, and before/after table counts.
• Sends the report through the existing preview timing artifact as seed telemetry.
• Repairs heterogeneous test fixtures whose sparse dictionary keys had drifted from SQLAlchemy's multi-row insert behavior.

What this PR does not change

• It does not relax a database constraint.
• It does not skip a migration.
• It does not change migration/seed ordering.
• It does not treat transient infrastructure errors as skippable data.
• It does not guarantee a fast seed when every row is invalid; that genuine worst case remains 2n - 1 probes.

Dependency and merge order

• This is stage 3 of the preview pipeline stack.
• It depends on ci(preview): fence stale generations from mutating preview state (stage 2) #1144, which depends on ci(preview): timing telemetry and preview ownership metadata (stage 1) #1142.
• Merge order: ci(preview): timing telemetry and preview ownership metadata (stage 1) #1142 → ci(preview): fence stale generations from mutating preview state (stage 2) #1144 → ci(preview): bisect invalid seed rows instead of replaying batches row-by-row (stage 3) #1151.
• Keep this PR in draft until the earlier stages land and the fix: preserve verdict state and skip cancelled preview gates #1139 production-shaped reproduction is below 60 seconds.

Validation completed

• 104 loader and preview-seed tests passed.
• The one-invalid-row, five-invalid-row, all-valid, all-invalid, composite-key, deterministic-report, and transient-error cases are covered.
• Existing bootstrap ordering tests passed: 21 tests.
• The DB-backed suite proves valid children land and invalid parent/child rows are reported with their constraint identities.

Remaining acceptance gate

• Run this branch's preview against the production-sampled legacy fixture that reproduced fix: preserve verdict state and skip cancelled preview gates #1139.
• Record total seed time, statements/probes, rows skipped, causes, and connection-pool behavior.
• Required result: under 60 seconds, invalid rows visible, no constraint relaxation, and transient failures fatal.

Risk

• A transient database failure that was previously hidden will now make preview red. That is intentional.
• Two aggregate count round trips are added for telemetry.
• A data set where nearly every row is invalid remains expensive and should be fixed at the source.

Rollback

Revert this PR to restore the old loader. The seed telemetry field is additive and consumers already tolerate its absence. Reverting also restores the unsafe broad fallback, so rollback should be temporary while the concrete failure is fixed.