feat: ADR-0035 4f — ALTER TABLE … ALTER COLUMN TYPE

Fourth AlterTableAction (AlterColumnType), runtime-decomposed to the
existing change_column_type executor with ForceConversion — which IS the
§7 advanced policy: lossy converts with a note (no force flag),
incompatible + the ADR-0017 static refusals (↔blob, same-type,
date↔datetime, non-int→serial) still refuse, while int→serial is allowed
(auto-fills nulls + UNIQUE, ADR-0018 §8). No new mode/note/persistence;
undo is the advanced safety net.

Grammar adds a fourth action branch leading on `alter`, discriminated in
the builder by the `type` keyword (unique — ADD COLUMN's type is an
ident); the type slot reuses SQL_TYPE. The internal-__rdbms_* guard was
folded into do_change_column_type (user-confirmed), closing the simple
`change column` exposure.

Tests: 7 Tier-3 e2e via run_replay + 4 Tier-1 parse (incl. a column-named-
`type` discriminator probe) + the simple-surface guard. Help/usage
refreshed; ADR-0035 §13 4f + README + requirements.md in lockstep.

src/db.rs

@@ -4279,6 +4279,11 @@ fn do_change_column_type(
     ty: Type,
     mode: ChangeColumnMode,
 ) -> Result<ChangeColumnTypeResult, DbError> {
+    // Refuse the internal `__rdbms_*` tables up-front (as "no such
+    // table"), like the sibling column executors. Closes the simple
+    // `change column` exposure and the SQL `ALTER COLUMN TYPE`
+    // decomposition target (ADR-0035 §4f); user-confirmed 2026-05-25.
+    reject_internal_table_name(table)?;
     let old_schema = read_schema(conn, table)?;
     let col_info = old_schema
         .columns