Add missing ck_* on migrate_updates

[0x054]

Part of #339

Parent

#339 — table checks (named multi-column CHECK), auto-migrated

What to build

migrate_updates=True adds a table check or column check that is on the model but missing live: ALTER TABLE … ADD CONSTRAINT on Postgres. Existing rows must pass or connect fails (and that table’s plan rolls back). SQLite warns with the constraint name and skips — no table rebuild.

Alembic autogenerate proposes the same add (no migrate_updates gate — running autogenerate is the request for a diff). Column db_check Field API does not change; toggling it on an existing column now actually adds ck_<table>_<col>.

Acceptance criteria

• Model gains a table check; second connect with migrate_updates=True on Postgres emits ADD CONSTRAINT; the CHECK exists in pg_constraint.
• Existing rows that violate the new CHECK fail the connect; the table is not left half-applied.
• Toggling Field(db_check=True) on an existing closed-domain column adds ck_<table>_<col> under migrate_updates on Postgres.
• SQLite reconcile of an existing table warns with the constraint name and does not emit ADD/DROP.
• Alembic autogenerate against that drifted database proposes ADD CONSTRAINT with the same name and body as runtime.
• A second migrate_updates boot with no model change is a no-op (no phantom add).
• Column adds that a new table check references land before the CHECK in the same run.

Blocked by

#341 — declare table checks and emit them on CREATE TABLE

• Introspect live ferro-owned CHECKs #342 — introspect live ferro-owned CHECKs

[0x054]

Landed via #353 (squash onto feat/table-checks). Parent #339 stays open.