Add a Syncable() mixin so sync composes with Agent-based Durable Objects

[grrowl]

Why

SyncDurableObject is a base class, and a JavaScript class can only have one base. A Durable Object that already extends another framework's base, e.g. the Agents SDK's Agent, cannot also be a sync scope. This PR turns the sync machinery into a mixin, so a class can extend Syncable()(Agent) and host both protocols on one Durable Object.

What changed

• src/server/mixin.ts holds the new Syncable(Base) factory, exported from the root and from ./server/mixin. SyncDurableObject is now the mixin applied to DurableObject, so existing imports and behavior do not change.
• Sync sockets are accepted with a reserved hibernation tag. The message, close, and error handlers check the tag and hand sockets they do not own to the parent class. Sync upgrades enter on a dedicated /_sync fetch path, and every other request falls through to the parent's fetch.
• The sql getter is deleted because it shadowed the sql tagged-template method on partyserver's Server and on Agent. The protected members now live on a this.sync facade.
• setWebSocketAutoResponse and the case_sensitive_like pragma are opt-in when the base is not DurableObject itself, because both settings apply to the whole Durable Object.
• Cold snapshots and paginated fetch reads now compile with ORDER BY rowid when the client sends no orderBy. Before this change the compiled SQL had no ORDER BY, and SQLite's planner could return rows out of insertion order. A consuming app hit this in the field, and the new regression test reproduces the failure on the old code. Rows seeded z, a, m came back a, m, z once the WHERE clause touched the primary key.
• ADR-0015 records the mixin decision, the snapshot ordering guarantee, and a note that Syncable() must not be applied twice.

Verification

• The full suite passes with 191 tests. No pre-existing test file was modified. The additions are a 10-case host-matrix suite over a fake partyserver-like base and 2 ordering tests, one of which was confirmed to fail against the unfixed code.
• A smoke test ran both protocols on one class extending Syncable()(Agent) against the real agents 0.17.3 package. The sync client received CDC rows, the agent client received setState broadcasts, the sync socket did not receive that broadcast, and Agent's sql method still worked. The agents package was a devDependency for the smoke only and was removed afterward.
• Grep checks across agents 0.17.3, partyserver 0.5.8, and @cloudflare/think 0.12.1 found no literal "ping" keepalive frame, no LIKE query that needs case-insensitive behavior, and no existing member named sync.

Known limits

@cloudflare/actors cannot host the mixin, because its Sockets helper adopts every hibernated socket at construction and closes sockets it does not recognize. ADR-0015 records this as unsupported.

🤖 Generated with Claude Code