Finalize SQLite statement before releasing control arguments

[birdmanmandbir]

What changed

• Construct the owned control argument before its SQLite statement, so every return and unwind path finalizes the statement before the argument can be released.
• Keep the SQLite STATIC binding semantics from Scope SQLite control argument lifetime #37 and document the all-exit lifetime reasoning at the unsafe call site.
• Keep coverage in the existing sync-client integration tests instead of duplicating the same control path locally.

Root cause

#37 explicitly finalized the statement on its successful path, but the statement was declared before the owned argument. Any later error path dropped the argument before ManagedStmt finalized SQLite, which violates SQLite STATIC binding requirements.

Validation

• cargo fmt --all --check
• cargo test --workspace --all-features

Follow-up to #37; no separate issue because this is a narrowly scoped correction to that merged PR.

[simolus3]

I agree this fix is better 👍