feat: ADR-0035 4e — ALTER TABLE add/drop/rename column

Advanced-only `alter` entry word; ALTER TABLE <T> ADD COLUMN <col> <type>
[constraints] | DROP COLUMN <col> | RENAME COLUMN <old> TO <new> ->
SqlAlterTable, runtime-decomposed to the existing column executors
(do_add_column / do_drop_column / do_rename_column) — one undo step each,
no new worker layer. The COLUMN keyword is required (reserves bare
RENAME TO for 4h, ADD CONSTRAINT for 4g).

- ADD COLUMN takes NOT NULL / UNIQUE / DEFAULT / CHECK (no PK / inline
  REFERENCES). do_add_column extended to consume the SQL raw-text
  default_sql / check_sql (sql_expr is validate-only, the 4a.2
  mechanism), reaching parity with CREATE TABLE's column constraints.
- Drop/rename column refuse a column any CHECK references — table-level
  AND column-level (incl. a column's own self-check on rename) — the
  4a.3 deferral, detected up-front by tokenizing the raw CHECK text
  (skipping string literals). In the shared executors, so it guards both
  the simple and SQL surfaces and fixes a latent rename-drift bug that
  desynced the stored CHECK text and broke rebuild.
- SQL DROP COLUMN refuses an index-covered column (no --cascade SQL
  spelling — matches SQLite + the simple default).
- The column executors and do_add_index gained an internal-__rdbms_*
  guard (refuse as "no such table"), closing a pre-existing exposure on
  both surfaces. (do_change_column_type / do_add_constraint /
  do_add_relationship are a tracked follow-up.)
- `alter` is advanced-only; AlterTableAction::AddColumn is boxed
  (clippy::large_enum_variant).

Docs: ADR-0035 status + §13 4e; ADR README; requirements.md Q1. Plan:
docs/plans/20260525-adr-0035-sql-ddl-4e.md.

Tests: 1854 passing / 0 failing / 0 skipped / 1 ignored; clippy clean.

src/runtime.rs

@@ -33,7 +33,7 @@ use crate::db::{
     Database, DbError, DeleteResult, DropColumnResult, DropIndexOutcome, DropOutcome, InsertResult,
     QueryPlan, TableDescription, UpdateResult,
 };
-use crate::dsl::{Command, ColumnSpec};
+use crate::dsl::{AlterTableAction, Command, ColumnSpec};
 use crate::dsl::walker::Severity;
 use crate::event::AppEvent;
 use crate::project::{
@@ -2095,6 +2095,26 @@ async fn execute_command_typed(
                 CreateIndexOutcome::Created(d) => CommandOutcome::Schema(Some(d)),
                 CreateIndexOutcome::Skipped(n) => CommandOutcome::SchemaCreateIndexSkipped(n),
             }),
+        // `ALTER TABLE` (ADR-0035 §4e) decomposes to the existing column
+        // executors — each already one snapshot (one undo step) and
+        // journalled. No new worker layer; the outcomes reuse the
+        // simple-mode add/drop/rename column paths.
+        Command::SqlAlterTable { table, action } => match action {
+            AlterTableAction::AddColumn(spec) => database
+                .add_column(table, *spec, src)
+                .await
+                .map(CommandOutcome::AddColumn),
+            // cascade = false: an index-covered column is refused (no SQL
+            // `--cascade` spelling), matching SQLite + the simple default.
+            AlterTableAction::DropColumn { column } => database
+                .drop_column(table, column, false, src)
+                .await
+                .map(CommandOutcome::DropColumn),
+            AlterTableAction::RenameColumn { old, new } => database
+                .rename_column(table, old, new, src)
+                .await
+                .map(|d| CommandOutcome::Schema(Some(d))),
+        },
         Command::AddConstraint {
             table,
             column,