The cleanup step deletes any file the shipped manifest does not list outside
the protected prefixes. A SQLite database kept under database/ (a path the
installer accepts) is user state that can never appear in a manifest, so an
update destroyed it. The keep-list now always includes the resolved database
file of every in-installation SQLite connection, plus its -wal/-shm/-journal
side files. Found by the 3.0.0-alpha.2 -> alpha.3 upgrade rehearsal.
