fix: address release review (WAL-aware sync hash, empty MCP inputs)

- Sync hashed only the main database file, but local edits can sit in
  the -wal sidecar, so an edited database could match an earlier build
  and be replaced. Checkpoint the WAL before hashing; if changes remain,
  never take the rebuilt-snapshot path.
- MCP tools rejected nothing for empty symbols/sections/kinds and
  returned an empty success; they now fail with INVALIDINPUT, as the CLI
  requires input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/idx-mcp/tests/mcp.rs

@@ -243,6 +243,17 @@ fn errors_carry_cli_codes() {
     assert!(is_error);
     assert_eq!(body["code"], "INVALIDINPUT");
 
+    for (tool, arguments) in [
+        ("get_quotes", json!({"symbols": []})),
+        ("compare_stocks", json!({"symbols": []})),
+        ("get_company", json!({"symbol": "BBCA", "sections": []})),
+        ("analyze_stock", json!({"symbol": "BBCA", "kinds": []})),
+    ] {
+        let (is_error, body) = client.call(tool, arguments);
+        assert!(is_error, "{tool}: {body}");
+        assert_eq!(body["code"], "INVALIDINPUT", "{tool}");
+    }
+
     // Empty ownership database: investor tools point at the sync path.
     let status = client.ok("ownership_status", json!({}));
     assert_eq!(status["populated"], false);