[M5+] add resolver::verify_link + provisional overlay lifecycle

CHANGELOG.md

@@ -78,6 +78,20 @@ All notable changes to cargoxx will be documented in this file.
   and `[build]` honoring `warnings_as_errors` and `sanitizers`. Source
   paths emitted relative to `build/` (i.e. prefixed with `../`).
   Output is deterministic. `tests/codegen_cmake.cpp` covers 11 cases.
+- `cargoxx.linkdb::Database::insert_provisional`,
+  `confirm_provisional`, and `abort_provisional` — three-step lifecycle
+  for non-`manual` overlay rows: insert with `verified_at = 0`, run a
+  build, then either bump `verified_at = now` on success or `DELETE`
+  the row on failure.
+- `cargoxx.resolver::verify_link(req, build_fn)` — scaffolds a tiny
+  `Cargoxx.toml` + `int main() {}` project under a scratch dir, writes
+  a provisional overlay row pointing at the candidate `Recipe`, runs
+  the caller-supplied `BuildFn` (typically `cli::cmd_build` injected
+  to avoid a resolver-on-cli dep cycle), and on success/failure
+  confirms or aborts the provisional row. Cleans the scratch project
+  via RAII regardless of outcome. `tests/verify_link_unit.cpp` exercises
+  both success and failure paths against a mock `BuildFn`, verifying
+  that the overlay row's lifecycle matches the build outcome.
 - `cargoxx.resolver::vcpkg_probe(name)` — fetches
   `https://raw.githubusercontent.com/microsoft/vcpkg/master/ports/<name>/usage`
   and feeds it through `parse_vcpkg_usage`. The pure parser extracts