docs(vendored): record the SQLite MAX_PATHNAME patch

The Unix-VFS MAX_PATHNAME bump from 512 to 4096 shipped with the daemon
work but left no paper trail, so the next amalgamation refresh would
silently revert it. Document it in vendored/sqlite3/PATCHES.md with the
rationale and re-apply procedure, and point to it from THIRD_PARTY.md.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

THIRD_PARTY.md

@@ -83,6 +83,12 @@ License summary:
 | Verstable | `internal/cbm/vendored/verstable/` | MIT | [JacksonAllan/Verstable](https://github.com/JacksonAllan/Verstable) |
 | wyhash | `internal/cbm/vendored/wyhash/` | Unlicense (public domain) | [wangyi-fudan/wyhash](https://github.com/wangyi-fudan/wyhash) |
 
+Local modifications to these libraries are documented next to the
+vendored sources (currently only SQLite: `vendored/sqlite3/PATCHES.md`,
+raising the Unix VFS `MAX_PATHNAME` ceiling from 512 to 4096 to match
+CBM's 4 KiB path support). Patches must be reapplied on every upstream
+refresh and are covered by `scripts/vendored-checksums.txt`.
+
 The graph-UI HTTP server is a first-party implementation
 (`src/ui/httpd.c` + `src/ui/http_server.c`) — no third-party HTTP library
 is used.

vendored/sqlite3/PATCHES.md

@@ -0,0 +1,18 @@
+# Local patches to the vendored SQLite amalgamation
+
+Reapply every patch below after refreshing the amalgamation, then update
+`scripts/vendored-checksums.txt` (`shasum -a 256 vendored/sqlite3/sqlite3.c`).
+
+## 1. Unix VFS path ceiling: `MAX_PATHNAME` 512 → 4096
+
+```c
+#define MAX_PATHNAME 4096
+```
+
+Upstream's Unix VFS caps full database paths at 512 bytes, while CBM
+supports 4 KiB paths everywhere else (cache roots under deep home
+directories, long project paths on Linux). With the upstream value,
+opening a store whose absolute path exceeds 512 bytes fails with
+`SQLITE_CANTOPEN`. 4096 matches `PATH_MAX` on Linux and CBM's own path
+buffers. Windows and the other VFS layers are unaffected (they do not
+use `MAX_PATHNAME`).