test(cli): guard graph-query marker control

The pre-write graph-query control only checked for an empty JSON result. If captured stdout and stderr ever contain the
query argument, the later marker grep could pass from echoed CLI input instead of a persisted sqlite-wasm row.

Failing when the marker appears before the write keeps the positive read-back assertion tied to stored graph data.

Validation:
- nixfmt modules/_checks/cli-graph-query.nix
- nix build .#checks.x86_64-linux.logseq-cli-graph-query
- git diff --check
- nix build .#checks.x86_64-linux.pre-commit-check

Author: Bad3r

modules/_checks/cli-graph-query.nix

@@ -51,6 +51,9 @@ pkgs.runCommand "logseq-cli-graph-query-check" { } ''
   if ! printf '%s\n' "$pre_output" | ${pkgs.gnugrep}/bin/grep -qF '"result":[]'; then
     fail "pre-write control query returned a non-empty result (marker leaked or query does not filter)" "$pre_output"
   fi
+  if printf '%s\n' "$pre_output" | ${pkgs.gnugrep}/bin/grep -qF "$marker"; then
+    fail "marker appeared in pre-write output; read-back output cannot distinguish CLI argument echoing from a stored row" "$pre_output"
+  fi
 
   # 3. Write a real block through the worker: the sqlite-wasm insert path.
   #    --target-page creates the page on demand, so no separate upsert page step.