🛡️ Sentinel: [HIGH] Fix SQL injection in PRAGMA statement

[mapleleaflatte03]

🚨 Severity: HIGH

💡 Vulnerability:
The MERIDIAN_OBSERVABILITY_SQLITE_JOURNAL_MODE environment variable was directly injected into a SQLite PRAGMA journal_mode={mode} statement string without any validation in intelligence/company/meridian_platform/observability_store.py. This poses a risk for Configuration/SQL Injection since the value was externally controllable and the SQLite driver does not support parameterized parameters (like ?) for PRAGMA statements.

🎯 Impact:
An attacker or misconfiguration controlling this environment variable could inject arbitrary values or queries, leading to application crashes, unexpected behavior, or theoretically further exploitation if PRAGMA string parsing could be abused.

🔧 Fix:
Added an explicit allowlist mapping strictly to valid SQLite journal modes ('DELETE', 'TRUNCATE', 'PERSIST', 'MEMORY', 'WAL', 'OFF', '', 'DEFAULT'). If the configured mode does not match a value in this strict allowlist, the system defaults safely back to 'WAL'.

✅ Verification:
Ran the test suite for test_alerting.py and test_status_surface.py in the meridian_platform module, confirming the functionality remains intact and no new regressions were introduced (existing test failures in test_status_surface.py are known environmental errors).

---

PR created automatically by Jules for task 4235648129985955424 started by @mapleleaflatte03

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.