feat(introspect): read live ferro-owned CHECK constraints (#342)

[0x054]

Summary

• Add LiveCheck and live_table_checks() in src/introspect.rs to read named CHECK constraints from live databases: Postgres via pg_constraint + pg_get_constraintdef, SQLite by parsing inline CONSTRAINT "…" CHECK (…) from sqlite_master.sql.
• Each result includes name, catalog definition (returned as-is for Rebuild a table check when the check predicate drifts #344), and ferro_owned (ck_* vs user-owned) so Add missing ck_* on migrate_updates #343 reconciliation can distinguish Ferro artifacts without silently dropping user CHECKs.
• Add _live_table_checks_for_test test FFI plus cargo/pytest coverage with planted SQL (transfer at-most-one-outflow example).

Closes #342

Test plan

• cargo test --no-default-features --features testing introspect::
• uv run pytest tests/test_live_table_checks.py --db-backends=sqlite -v
• uv run pytest tests/test_live_table_checks.py --db-backends=postgres -v (CI / local Postgres)
• Issue closure keyword present in PR body

Made with Cursor

[0x054]

Gate: clear

Read the full diff (introspect, parser, FFI, cargo + pytest). AC for #342 is met.

• LiveCheck { name, definition, ferro_owned } + is_ferro_check_name (ck_*)
• Postgres: pg_constraint + pg_get_constraintdef, unprepared + binds (matches FK introspect)
• SQLite: named inline CONSTRAINT … CHECK (…) from sqlite_master; unnamed CHECKs skipped with a test pin (ADR-0014 Ferro names them)
• User-owned CHECKs returned with ferro_owned: false, not dropped
• Definitions catalog-as-is (no Rebuild a table check when the check predicate drifts #344 normalizer)
• Test FFI only; migrate.rs / compiler / emit untouched

Merging into feat/table-checks once the Python matrix is green. Does not close parent #339.