cmake: detect RocksDB version from version.h when pkg-config misses

The previous patch printed a WARNING when neither find_package nor
pkg-config exposed RocksDB_VERSION (the manual-probe path used on hosts
like Ubuntu 22.04 whose librocksdb-dev ships no CMake config and no .pc
file). That's a cop-out — version drift is exactly what let v5.9.24
ship linked to librocksdb 6.11.

rocksdb/version.h has shipped with every RocksDB release since 3.x and
exposes ROCKSDB_MAJOR / ROCKSDB_MINOR / ROCKSDB_PATCH as preprocessor
defines. Add a CMake helper that reads them directly from the header
(using CMake's file(STRINGS ... REGEX) — no compile step needed) and
sets RocksDB_VERSION to 'X.Y.Z'. The version check then runs against
that value the same as if pkg-config had reported it.

Tested locally:
  - System RocksDB 8.9.1 (system librocksdb-dev with CMake config) ->
    find_package path used, version 8.9.1, build allowed.
  - Stubbed rocksdb/version.h with #define ROCKSDB_MAJOR 6 / MINOR 11 /
    PATCH 0 -> detected 6.11.0, build correctly fails with FATAL_ERROR.
  - Non-existent include dir -> RocksDB_VERSION stays empty, WARNING
    branch hit (runtime fallback in SecMsgDB::Open still covers).

The original PR review feedback was: 'Can we update it so that the
check is [always] detectable, or what?' This commit answers 'or what'
by closing the gap that made the bug recur.

CMakeLists.txt

@@ -138,21 +138,66 @@ endif()
 # checksum, type 4). Building against an older RocksDB produces a binary
 # whose smsgDB Open() fails on any SST file written by RocksDB 7.4+ —
 # instead of just bailing, src/smessage.cpp::SecMsgDB::Open now
-# quarantines the offending file and recovers. We still prefer to fail
-# loudly here so this drift doesn't sneak back in unnoticed.
+# quarantines the offending file and recovers. We still fail loudly at
+# configure time so this drift doesn't sneak back in unnoticed.
+
+# rocksdb/version.h ships with every RocksDB release (3.x onward) and
+# defines ROCKSDB_MAJOR / ROCKSDB_MINOR / ROCKSDB_PATCH. If neither
+# find_package nor pkg-config exposed RocksDB_VERSION (e.g. Ubuntu 22.04's
+# librocksdb-dev, which ships no CMake config and no .pc file), we can
+# still recover the version directly from the header. This closes the
+# "manual probe silently allows old RocksDB" gap that let v5.9.24 ship
+# linked to librocksdb 6.11.
+function(_tri_detect_rocksdb_version_from_header)
+    if(RocksDB_VERSION)
+        return()
+    endif()
+    foreach(_dir ${ARGN})
+        if(NOT IS_DIRECTORY "${_dir}")
+            continue()
+        endif()
+        set(_vh "${_dir}/rocksdb/version.h")
+        if(EXISTS "${_vh}")
+            file(STRINGS "${_vh}" _maj REGEX "^#define ROCKSDB_MAJOR ")
+            file(STRINGS "${_vh}" _min REGEX "^#define ROCKSDB_MINOR ")
+            file(STRINGS "${_vh}" _pat REGEX "^#define ROCKSDB_PATCH ")
+            if(_maj AND _min AND _pat)
+                string(REGEX MATCH "[0-9]+" _maj "${_maj}")
+                string(REGEX MATCH "[0-9]+" _min "${_min}")
+                string(REGEX MATCH "[0-9]+" _pat "${_pat}")
+                set(RocksDB_VERSION "${_maj}.${_min}.${_pat}" PARENT_SCOPE)
+                message(STATUS "Detected RocksDB version from version.h: ${RocksDB_VERSION}")
+                return()
+            endif()
+        endif()
+    endforeach()
+endfunction()
+
+if(NOT RocksDB_VERSION AND TARGET RocksDB::rocksdb)
+    get_target_property(_rocksdb_inc RocksDB::rocksdb INTERFACE_INCLUDE_DIRECTORIES)
+    if(_rocksdb_inc)
+        _tri_detect_rocksdb_version_from_header(${_rocksdb_inc})
+    endif()
+endif()
+
+if(NOT RocksDB_VERSION AND ROCKSDB_INCLUDE_DIR)
+    _tri_detect_rocksdb_version_from_header(${ROCKSDB_INCLUDE_DIR})
+endif()
+
 if(RocksDB_VERSION AND RocksDB_VERSION VERSION_LESS "7.4.0")
     message(FATAL_ERROR
         "Triangles requires RocksDB >= 7.4.0 (got ${RocksDB_VERSION}). "
-        "Older versions cannot read smsgDB files written by RocksDB 7.4+. "
+        "Older versions cannot read smsgDB files written by RocksDB 7.4+ "
+        "(XXH3 per-block checksum). "
         "On Debian/Ubuntu: install librocksdb-dev >= 7.4 from a backports "
         "repo or build RocksDB from source into /usr/local.")
-elseif(NOT RocksDB_VERSION AND NOT TARGET RocksDB::rocksdb)
-    # Manual-probe path (e.g. Ubuntu 22.04's librocksdb-dev ships no CMake
-    # config / pkg-config metadata). We can't see the version, so warn
-    # instead of failing — the runtime self-heal in SecMsgDB::Open covers
-    # the gap, but this drift is what made the bug recur in the first place.
+elseif(NOT RocksDB_VERSION)
+    # No version detectable: headers missing entirely, or ROCKSDB_INCLUDE_DIR
+    # not pointing at one with rocksdb/version.h. Runtime fallback in
+    # SecMsgDB::Open covers the gap; print WARNING so build logs flag it.
     message(WARNING
-        "Could not determine RocksDB version (manual-probe path). "
+        "Could not determine RocksDB version (no CMake config, no "
+        "pkg-config metadata, and no rocksdb/version.h found). "
         "Triangles prefers RocksDB >= 7.4.0; older versions are recovered "
         "at runtime via SecMsgDB::Open's quarantine fallback.")
 endif()