[sdogruyol]

What

iyi 0.21.0 refuses an operation on raw memory in a module that doesn't say it handles some (SPEC.md III.13). That covers a Pointer from to_unsafe, the buffer of String.new(n) { |buffer| } and a Pointer parameter. A module says so with one @[Unsafe("why")] above its module header, a mark 0.20.x refuses. 0.21.0 also adds safe calls for the common cases: String#byte_at, Bytes.of and String.new(Array(UInt8)).

On 0.21.0, master is refused in 13 of its own modules. It is also refused in iyi-db v0.4.0's db, db/core and db/pooling, which only an iyi-db release with marks clears. The spawn changes in 0.21.0 break nothing here.

This PR:

• Marks the four modules that really work on raw memory, each with its reason: pg/pq/stream (the socket's read and write buffers), pg/pq/connection (read_direct's pointer into the caller's buffer), pg/copy_result (a copy read straight into the caller's slice) and pg/pq/scram (the HMAC pads and client proof written into new strings).
• Safe calls where the raw memory was an exact stand-in for one: pg/core, pg/pq/frame, pg/pq/param, pg/replication/messages, examples/simple_query and the tests escape_test, pq/param_test, pq/stream_test and replication_test use String.new(bytes), Bytes.of and byte_at. The compiler checks them.
• Minimum iyi 0.21.0 in CI's IYI_VERSION and README Requirements, plus a CHANGELOG Unreleased entry.
• iyi.mod requires github.com/iyilang/db v0.5.0, the release that Require iyi 0.21.0: spawn(unit: :new) and the III.13 unsafe marks db#3 would become. 0.21.0 refuses every earlier iyi-db.

Depends on iyilang/db#3 being released as v0.5.0

That tag doesn't exist yet, so CI on this PR fails at fetch until it does: cannot fetch github.com/iyilang/db v0.5.0 ... Remote branch v0.5.0 not found. After db#3 is merged and tagged v0.5.0:

• run iyi get github.com/iyilang/db@v0.5.0 on this branch, which writes the iyi.sum line (it still lists v0.4.0);
• if the tag ends up named differently, change the require line to match.

No pin that is on GitHub today passes. v0.4.0 is refused by 0.21.0, and the only alternative is a pseudo-version of an unmerged branch.

Tests (iyi 0.21.0 release binary, Linux x86_64, 12 vCPU)

The iyi-0.21.0-linux-x86_64.tar.gz from the v0.21.0 release, checked against SHA256SUMS. Against a local PostgreSQL 18.6 with DATABASE_URL=postgres://postgres:postgres@127.0.0.1/iyi_pg_test, the steps are CI's, except the TLS step, which wasn't run:

• As committed (require ... v0.5.0): iyi test pg 0 passed, 21 failed, and the 4 examples fail, all at the fetch error above. iyi fmt --check pg.iyi pg examples passes. This is what CI shows until the tag exists.
• With a local, uncommitted replace github.com/iyilang/db => ../iyi-db pointing at db#3's branch (15ed9dd): iyi test pg 21 passed, 0 failed; command, listen_notify, shoddy_psql and simple_query build; fmt --check passes.