Add static if compile boundary

[sabino]

Summary

• add narrow static {% if %} rendering in the compiler for literal true/false, execute, not execute, is_incremental(), and not is_incremental()
• keep compile/run-style execute rendering true while leaving is_incremental() false until incremental state exists
• add scanner and CLI coverage proving guarded refs/sources stay in manifest dependencies while compiled SQL renders the selected branch
• document source-grounded boundaries and stop before runtime Jinja, run_query, adapter introspection, elif, and complex expressions

Validation

• zig test src/project/compiler.zig --cache-dir /tmp/dxt-zig-cache-compiler --global-cache-dir /tmp/dxt-zig-global-cache-compiler
• zig test src/project/jinja.zig --cache-dir /tmp/dxt-zig-cache-jinja --global-cache-dir /tmp/dxt-zig-global-cache-jinja
• pytest -q tests/test_cli.py::test_compile_renders_static_if_without_losing_parse_dependencies
• zig build --cache-dir /tmp/dxt-zig-cache --global-cache-dir /tmp/dxt-zig-global-cache
• zig build test --cache-dir /tmp/dxt-zig-cache-test --global-cache-dir /tmp/dxt-zig-global-cache-test
• python scripts/check_runtime_boundary.py
• python scripts/check_public_safety.py
• pytest -q tests/test_cli.py
• zig fmt --check src/project/compiler.zig src/project/jinja.zig
• git diff --check
• targeted local-path/secret-marker scan across changed files