Changelog

The cloud sync engine was successfully downloading and decrypting

entities from S3, but the mpsc receiver (_event_rx) was immediately

dropped at the FFI boundary in start_sync. This meant all inbound

FullSnapshot events were silently lost — push worked (local→cloud)

but pull was completely broken (cloud→local).

Added consume_inbound_events() background task that reads from

event_rx and applies each event to the local entity_store using

save_entity (with schema for indexed fields) or save_entity_raw.

Includes LWW conflict resolution at document level — newer local

entities are preserved over older remote events. Also added

clone_schemas() to EntityRegistry for passing schemas to the

background task.

ValidateLicense() now only parses the license (format, signature, expiry)

without requiring runtime initialization. Device activation is deferred to

ActivateLicenseOnDevice(), called from InitializeServiceAndContinue() after

runtime is initialized. Fixes "PrivStack service is not initialized" error

when License step precedes workspace creation in the new setup wizard flow.

When DuckDB has a stale implicit transaction active, BEGIN TRANSACTION

fails with "cannot start a transaction within a transaction". The dry-run

path now catches this error, rolls back the stale transaction, and retries.

This fixes INSERT/UPDATE/DELETE operations via the SQL editor's source:

alias syntax.