fix: reject non-zero sub-millisecond DateTime digits

[azimafroozeh]

What & why

Closes #857. DateTime inputs such as .123456 silently stored and compared as .123 because storage holds milliseconds.

• Reject non-zero fractional digits past the third in literals, query parameters, and loads; keep accepting zero padding such as .123000.
• Generate now() at millisecond precision and reject caller bindings of its reserved __nanograph_now parameter.

Backing issue / RFC

• Fixes #857, with an issue_857 GQT regression case.

Checklist

• Change is focused (enforce millisecond-exact DateTime inputs).
• Tests added for literal, parameter, load, zero-padding, and reserved-clock behavior, including direct Rust bindings.
• Public docs updated (schema, queries, mutations, skill references, and release notes).
• Reviewed against docs/dev/invariants.md (no storage-format or publication change).

Local verification

The following runs predate the latest reserved-clock and Rust list-validation fixes; those changes still need verification.

• cargo test -p omnigraph-gqt --locked -q: 471 passed, including 253 corpus cases.
• cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-dst --locked --features omnigraph-engine/failpoints,omnigraph-cluster/failpoints --no-fail-fast -q: 3,631 passed, 26 ignored, 3 CLI managed-session failures with session_lock_unavailable in the sandbox.
• cargo clippy --workspace --all-targets --locked -q --message-format=short -- -D warnings -W clippy::dbg_macro: passed.
• cargo fmt --all --check: passed.

Vocabulary recheck: target/debug/omnigraph-vocabulary-guard check --surface rust-string --base 92f5f953 --inventory tools/omnigraph-vocabulary-guard/graph-vocabulary-inventory.tsv --openapi openapi.json fails on 1,630 merge-base inventory errors before checking the patch. The same command with --surface openapi passes; --surface user-docs is unsupported. The earlier comment check failed only on unchanged exec/merge.rs because the branch trails upstream.

Notes for reviewers

• Breaking: clients must trim non-zero sub-millisecond digits explicitly. Zero padding remains accepted. Correct affected stored-query literals before upgrading; Python callers can use isoformat(timespec="milliseconds").
• Rust ParamMap callers must use Literal::DateTime, or a Literal::List of them for [DateTime]. Nullable parameters accept whole-value Literal::Null; list elements cannot be null.
• Caller bindings of __nanograph_now now fail instead of replacing the engine clock.