Drop orphaned ck_* under migrate_destructive

[0x054]

Part of #339

Parent

#339 — table checks (named multi-column CHECK), auto-migrated

What to build

An orphaned ferro-owned ck_* (live, gone from the model — table check removed, or db_check=True cleared) drops only under migrate_destructive. Under migrate_updates it stays and Ferro warns with the live name. User-created CHECKs (any other name) are never touched.

Alembic autogenerate always proposes DROP CONSTRAINT for an orphaned ferro ck_* — the destructive gate is connect-time safety only.

Acceptance criteria

• Remove a Check(...) from the model; migrate_updates=True leaves the live constraint and warns naming it.
• The same state with migrate_destructive=True drops it on Postgres.
• Removing db_check=True follows the same warn / destructive-drop rule.
• A hand-created CHECK whose name does not start with ck_ survives both flags.
• SQLite warns and skips the drop (no table rebuild).
• Alembic autogenerate proposes DROP CONSTRAINT for the orphaned ferro name even when auto-migrate would not drop yet.

Blocked by

#344 — rebuild a table check when the check predicate drifts

[0x054]

Landed via #355 (squash onto feat/table-checks). Parent #339 stays open until the integration PR to main.