Schema change governance

Agent-written migrations need review of declared intent, not just the SQL diff

A dev.to post walks through an eighty-line ALTER TABLE that no reviewer can judge from text, which is the argument for moving the gate off reading and onto a restored copy with real row counts and a clock on the lock.