feat(vigil): vigil persistence and dirge vigil CLI (slice 1 of 5)

[allen-munsch]

Follow-up to #765, which was closed as too large to review comfortably. This is the first slice of the decomposition agreed in #760 (ELEGY-1): split the monolithic vigil phase-5 branch into small, individually-mergeable PRs, with the queue/reaper core in Rust and the external engine adapters (Jenkins/Prefect/Airflow) in the Janet plugin space.

What this slice does

• Adds the vigil persistence layer: VigilStore (SQLite) with Active/Paused/Resting status and list_non_resting filtering.
• Adds the vigil config types (VigilEntry, VigilTrigger, VigilRite, VigilCommand, SocketMode), gated on a new vigil feature.
• Adds the dirge vigil CLI subcommand (list, add, remove, pause, resume, rest).
• Documents the vigils top-level config key.

It is deliberately not the runtime: no keeper, no triggers, no TUI panel. Just the store and the management surface.

Why this shape

The crate is bin-only (no src/lib.rs), and CI fails on any dead_code under -D warnings. That means I could not land the keeper/trigger runtime first with no caller: it would not compile standalone. The CLI CRUD arm exercises every store method, so this slice has no dead code and stands on its own.

Two things the monolithic branch masked, which I had to fix while extracting this slice:

• The serde::Serialize import in src/config/mod.rs was un-gated, which is an unused-import warning whenever vigil is off.
• The config-free dispatch match needed a Vigil { .. } => {} arm to stay exhaustive.

Decomposition plan (the rest of the stack)

• Slice 1 (this PR): vigil DB + dirge vigil CLI CRUD.
• Slice 2: core runtime (toll/watcher/harbinger triggers, reaper, rite, dispatch, keeper) + --vigil-once headless path.
• Slice 3: interactive TUI wiring (panels, slash commands).
• Slice 4: Janet plugin bridge + hooks.
• Slice 5: docs + e2e fixtures.

Each later slice carries the relevant review fixes from the original #765 review (the drg-* findings) so the fixes land with the code they protect rather than arriving as a separate cleanup PR.

Verification

• cargo fmt --all --check clean
• cargo clippy --all-targets --all-features -- -D warnings clean
• cargo clippy --all-targets --no-default-features --features windows-default -- -D warnings clean
• cargo build --bin dirge --no-default-features --features windows-default clean
• cargo build --bin dirge clean (vigil off)
• cargo test --bin dirge --all-features vigil 12 passed
• cargo test --bin dirge --all-features config:: 166 passed
• cargo test --bin dirge --all-features cli:: 16 passed

Questions for maintainers

• Is vigil staying opt-in (not in default), or should it join the default feature set as the original branch had it? I left it opt-in here to keep this slice minimal, and will gladly move it into default if that is preferred.
• Does this slice ordering match how you want the runtime to land, or would you rather see the keeper/trigger core before the CLI management layer? Slice 2 is the one that needs the most careful hunk surgery, so I would like to confirm the direction before building it out.