ADR-0017 implementation: per-cell type-change with override flags

Replaces the placeholder "trust STRICT" body of do_change_column_type
with the per-cell transformer matrix from ADR-0017. Adds:

- src/type_change.rs: CellOutcome { Clean / Lossy / Incompatible }
  + transform_cell + static_refusal covering every matrix pair
  from §3 (54 unit tests).
- --force-conversion and --dont-convert flags on `change column`
  (mutually exclusive at parse time per §5).
- Refined PK rule (§4.1): refused only when the column has an
  inbound FK and fk_target_type would change. Outbound-FK columns
  still refused outright (§4.2). PK / shortid uniqueness checked
  post-transformation (§4.3).
- Bordered diagnostic tables (lossy / incompatible / collision)
  via the pretty-table renderer (§7) — uses ADR-0016's primitives.
- [client-side] success note (§6) when any cell was rewritten.
- Friendly wrapper for engine-level errors under --dont-convert
  so no engine vocabulary leaks (ADR-0002 user-facing posture).

ADR-0017 §3 + §7 amended in place (with user sign-off): serial->int
added explicitly to the always-clean matrix, and diagnostic rows
identify themselves by PK value(s) rather than positional indices
(SQLite returns rows unordered without ORDER BY, so positional
"row 5" is unaddressable).

Tests: 449 -> 517 (+68). Clippy clean with nursery lints.

src/output_render.rs

@@ -136,11 +136,38 @@ pub fn render_structure(desc: &TableDescription) -> Vec<String> {
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum Alignment {
+pub enum Alignment {
     Left,
     Right,
 }
 
+/// Per-column alignment hint for [`render_diagnostic_table`].
+#[must_use]
+pub const fn numeric_alignment_for(ty: Type) -> Alignment {
+    alignment_for(Some(ty))
+}
+
+/// Render an arbitrary bordered table from headers + rows +
+/// per-column alignments. Used for change-column diagnostic
+/// output (ADR-0017 §7) — anything tabular goes through the
+/// pretty-table renderer.
+///
+/// Cell contents are sanitised the same way as
+/// [`render_data_table`]: newlines and control characters
+/// become visible markers (display-only).
+#[must_use]
+pub fn render_diagnostic_table(
+    headers: &[String],
+    rows: &[Vec<String>],
+    alignments: &[Alignment],
+) -> Vec<String> {
+    let body: Vec<Vec<String>> = rows
+        .iter()
+        .map(|r| r.iter().map(|c| sanitize_cell(c)).collect())
+        .collect();
+    render_table(headers, &body, alignments)
+}
+
 /// Map a user-facing type to its column alignment per
 /// ADR-0016 §2. `None` (foreign-attached, no metadata)
 /// falls back to Left.