fix(test): Windows CI fails on mediadb tests that unlink or read SQLite files while still open

[wizzomafizzo]

Lint and Test fails on the windows-latest job on main at 5edd9919.
Linux, macOS, Actionlint and CodeQL all pass on the same commit. Run:
https://github.com/ZaparooProject/zaparoo-core/actions/runs/33719674259

Two failures, both the same underlying cause: a SQLite file is still open when
the test tries to read or delete it. Windows enforces mandatory file locking, so
what is harmless on Linux and macOS is an error there.

TestMediaDB_Recreate_KeepBackup_PreservesConsistentForensicSet

pkg/database/mediadb/forensic_set_test.go:90

Error: Received unexpected error:
       failed to remove corrupt media database: remove
       D:\a\_temp\msys64\tmp\zaparoo-test-mediadb-322697109\media.db:
       The process cannot access the file because it is being used by another process.

The recreate path unlinks media.db while a connection still holds it.

TestCrashConsistency_SpilledUncommittedFramesAreInvisible

pkg/database/mediadb/crash_consistency_test.go

Error: Received unexpected error:
       read D:\go-tmp\TestCrashConsistency_SpilledUncommittedFramesAreInvisible608634906\001\test.db-shm:
       The process cannot access the file because another process has locked a portion of the file.

testing.go:1617: TempDir RemoveAll cleanup: unlinkat
       D:\go-tmp\...\001\test.db: The process cannot access the file because it is being used by another process.

The test reads test.db-shm directly while SQLite still has the shared-memory
region mapped, and then t.TempDir cleanup cannot unlink test.db either.

Is it a regression?

Probably not, but this is not established. Both test files last changed in #1370,
which is an ancestor of v2.17.0, so neither test has been touched since the last
release. However every earlier Lint and Test run on main in this series was
cancelled by the following push — 5edd9919 is the first to run to completion —
so there is no green Windows baseline to compare against. Three of the nine
commits since v2.17.0 do touch pkg/database/mediadb/: #1383, #1382 (itself
about Windows and macOS test races) and #1381.

Re-running the Windows job would settle whether this is deterministic or flaky.

Note on release gating

.github/workflows/build.yml triggers on push: tags: v* and has no needs:
on lint-and-test.yml, so a release tag builds, signs and publishes whether or
not this job is passing. v2.17.1 was tagged on 5edd9919 with these failures
outstanding, deliberately. Worth deciding separately whether the release build
should gate on tests.

Fix direction

Both are test-side lifecycle problems rather than product defects — the
production code closes its handles, the tests just do not wait for it. Close (or
checkpoint and close) the database before unlinking or reading sidecar files,
and make setupTempMediaDB's cleanup close every connection before TempDir
removal runs.