fix(app): hold input until the schema-cache refresh lands (#39)

A simple-mode Form-B insert (`insert into T values (…)`) submitted faster
than the post-DDL schema-cache refresh was validated against the stale
cache and wrongly rejected as "trying to write SQL?". The cache is
refreshed asynchronously after the worker applies a command, posting
`SchemaCacheRefreshed` on the same FIFO channel as key events; under
faster-than-human input the next Enter is processed before the refresh.

Add a submission gate: `dispatch_dsl` arms `awaiting_schema_refresh` on
every `ExecuteDsl` dispatch, holds further DSL submissions in a
`held_submissions` FIFO while armed, and the `SchemaCacheRefreshed`
handler drains them against the fresh cache in submission order.
App-lifecycle commands bypass the gate. Arm-on-every-dispatch keeps
exactly one DSL command in flight, so the boolean is provably correct.
Interactive-only: the replay/batch path already re-snapshots the schema
synchronously per line. No interactive-user impact; held input is never
lost (a refresh always follows a dispatch).

Tests (both verified red→green): a Tier-1 deterministic ordering test and
a Tier-4 PTY back-to-back regression (the unpaced inverse of flow 3).
Records the design as ADR-0022 Amendment 8.

tests/it/walking_skeleton.rs

@@ -170,6 +170,12 @@ fn colon_escape_in_simple_mode_is_one_shot() {
         echoed.text,
     );
 
+    // Issue #39: dispatching `:select 1` arms the schema-refresh gate (a
+    // cache refresh is conceptually in flight). In the real runtime that
+    // refresh lands before the user types the next line; model it here so
+    // the follow-up submission is processed rather than held.
+    app.update(AppEvent::SchemaCacheRefreshed(app.schema_cache.clone()));
+
     // Subsequent submission (unrecognised in simple mode) parse-errors,
     // not echoes — confirming the mode reverted.
     type_str(&mut app, "list things");