feat: ADR-0036 Phase 2 — validate advanced-mode UPDATE SET literals + retain the value

Mirror Phase 1's capture-at-parse technique on the UPDATE SET assignment
list. build_sql_update calls the new capture_set_literals (data.rs), which
walks the matched tokens (no reparse, no grammar change) and classifies
each top-level `SET col = <rhs>` as a literal (Some, incl. signed numbers)
or an expression (None), using paren depth so a comma inside a function
call or a `where` inside a scalar subquery is not mistaken for a boundary,
and the trailing top-level WHERE is excluded.

Command::SqlUpdate gains set_literals; do_sql_update validates the literals
against their column types via the shared impl_value_for before the still
verbatim update; user_value_for_column reads them so a constraint error
names the offending value. WHERE stays unvalidated; execution and command
identity are unchanged.

Also corrects the stale data.rs header comment (DSL typed slots are wired,
not "deferred") and flips ADR-0036 + README to Phases 1–2 implemented.

Tests: 1934 passing (+4), 0 failed, 0 skipped, 1 ignored; clippy clean.

src/app.rs

@@ -3865,6 +3865,7 @@ mod tests {
                 sql: "update t set v = 1".to_string(),
                 target_table: "t".to_string(),
                 returning: false,
+                set_literals: Vec::new(),
             },
             result: crate::db::UpdateResult {
                 rows_affected: 2,
@@ -3897,6 +3898,7 @@ mod tests {
                 sql: "update t set v = 1".to_string(),
                 target_table: "t".to_string(),
                 returning: false,
+                set_literals: Vec::new(),
             },
             result: crate::db::UpdateResult {
                 rows_affected: 1,