feat(enrichment): SQL migration-safety linter analyzer

[JSONbored]

New REES local analyzer (an explicit later idea in the #1499 epic) that flags risky operations in added migration SQL: DROP COLUMN/TABLE, non-nullable ADD COLUMN without DEFAULT, RENAME, and blocking table rewrites — schema changes that can break running deployments. Pure compute over added lines in migrations/**.sql (and common migration dirs), no network.

Deliverables

• Add MigrationSafetyFinding ({ file, line, kind: 'drop'|'rename'|'not-null-no-default'|'blocking-rewrite' }) + migrationSafety? key to review-enrichment/src/types.ts
• Create review-enrichment/src/analyzers/migration-safety.ts: detect migration paths (migrations/, db/migrate/, *.sql) and match risky statements on added lines only; cap with maxFindings
• Register a local descriptor (category 'config', cost 'local', requires ['files']) with inline render() in review-enrichment/src/analyzers/registry.ts
• Add review-enrichment/test/migration-safety.test.ts covering each risky kind, a safe additive migration (nullable/defaulted column) not flagged, and the cap

References

• review-enrichment/src/analyzers/iac-misconfig.ts (config-category local pattern-matcher template)
• review-enrichment/src/analyzers/registry.ts:303-319 (iacMisconfig descriptor)
• gh issue 1499 explicitly lists 'SQL migration safety analyzer' as a later idea

Part of #1499.

---

size: S · gittensor:feature

[linear-code]

JSO-2139