Fix nondeterministic variable substitution

[pinodeca]

Summary

• replace HashMap-ordered user variable replacement with a single left-to-right template scan
• keep inserted values opaque so placeholder-like text is not rescanned
• add regression tests for insertion-order independence, system variables, and unknown placeholders
• document transitive orchestration determinism requirements for future AI-assisted changes

Validation

• cargo fmt -p pg_durable -- --check
• cargo test --lib --features pg17 (256 passed, 16 ignored)
• git diff --check

Fixes #309