Summary

Five small, isolated bug fixes from the maintenance sweep — each fixes a subtle bug in already-shipped code. Bundled because they all share that shape and don't interact.

• P1.1 BigQuery JWT not cached (rocky-bigquery/src/auth.rs)
  Service Account auth was minting + exchanging a fresh JWT on every API call (~100ms/call). Added an Arc<RwLock<Option<CachedToken>>> keyed by the BigQueryAuth instance, mirroring the Databricks pattern (60s REFRESH_SLACK). The cache uses Google's expires_in from the token-exchange response. New invalidate_cache() for post-401 retries. The ServiceAccount enum variant is now struct-form { key, cached_token }.

• P1.2 rocky-sql transpile corruption (rocky-sql/src/transpile.rs)
  String::replace walked the whole SQL body, corrupting string literals, line/block comments, and identifier substrings (e.g. mapping INT64 → BIGINT incorrectly hit inside INT-prefixed words). Added a single-pass walker that tracks LineComment / BlockComment / '…' / "…" / `…` state (with doubled-quote escape handling), and requires ASCII word boundaries on type tokens. Function tokens (e.g. NVL() are still literal but skip strings/comments.

• P1.3 WASM byte_offset_to_line_col panic (rocky-wasm/src/lib.rs)
  An offset past source.len() or mid-char into a multi-byte UTF-8 character would panic the slice. Clamp to text.len() and walk back to the nearest char boundary via is_char_boundary.

• P1.4 explain.save_intent_to_config clobber (rocky-ai/src/explain.rs)
  When the existing TOML sidecar failed to parse, the prior unwrap_or(empty) silently overwrote the file with a fresh intent = "..." document, deleting the user's in-flight edits. Now returns Err(io::Error::other("refusing to overwrite unparseable TOML at <path>: …")).

• P1.5 Partial-success exit code 2 (rocky-cli/src/commands/run.rs, rocky/src/main.rs)
  Documented contract said partial failures exit 2, but the post-JSON bail! always returned exit 1, so dagster allow_partial=True couldn't distinguish partial from total failure. Defined a PartialFailure sentinel next to Interrupted, branched the bail! site on derive_run_status(), and added the downcast in main.rs (PartialFailure → exit 2, mirroring Interrupted → exit 130). Total failure (no tables copied) still exits 1.

Test plan

• cd engine && cargo test -p rocky-bigquery -p rocky-sql -p rocky-wasm -p rocky-ai -p rocky-cli — all green (incl. new tests for each fix).
• cd engine && cargo clippy --all-targets -- -D warnings clean.
• cd engine && cargo fmt --check clean.
• Full cargo test workspace-wide — no regressions.

New regression tests:

• BigQuery: cache-hit returns cached token, expired token rejected by read_fresh_token, invalidate_cache clears the entry, invalidate_cache is a no-op on Bearer.
• rocky-sql: word boundaries (INT vs BIGINT), function/type replacement skips string literals + line + block comments, doubled-quote escape inside literals round-trips.
• rocky-wasm: offset past end, multi-byte char at EOF (é), mid-char offset (日本語).
• rocky-ai: refuses to clobber unparseable TOML and asserts the file is byte-identical after the failed call; merges into valid TOML; creates fresh sidecar when missing.

No *Output structs touched, so no just codegen cascade. No DSL change.