Add MariaDB 10.6 and 10.11 worker backends

[vitormattos]

Summary

Implement the MariaDB branch of the worker contract introduced by #140/#144.

Changes

• add explicit MariaDB 10.6 and 10.11 database services with pinned image digests;
• select the supported MariaDB series programmatically through MARIADB_VERSION;
• keep DB_TYPE=mariadb separate from DB_HOST and use the MySQL-compatible Nextcloud driver;
• add a generic DB_SQL_MODE mechanism for deterministic global SQL mode configuration;
• add db-exec to the worker lifecycle for database-level verification;
• add Bats coverage for service/version mapping and unsupported versions;
• add CI matrix coverage for MariaDB 10.6 and 10.11, including ONLY_FULL_GROUP_BY, Nextcloud installation, and two-worker isolation;
• document the supported versions and SQL-mode contract.

Compatibility

This branch is rebased on the current main, which already includes the SQLite worker backend from #145. Existing SQLite, MySQL and PostgreSQL behavior is preserved; this PR adds only the MariaDB layer.

Validation

• commit created through the signed Git MCP;
• DCO trailer matches the configured identity;
• GitHub reports the OpenPGP signature as verified;
• CI will exercise Compose, ShellCheck, both MariaDB versions and worker isolation.

Closes #142