feat(checks): full check-predicate dialect (#346)

[0x054]

Summary

• Extend compile_table_checks / _lower_node to lower the full root-column where() dialect into CheckExpr IR: comparisons, column-to-column, .in_(), .like(), enum member literals, plus existing NULL/OR/NOT combinators.
• Reject closed-over variables (except enum classes used as Status.MEMBER spellings) and arbitrary function calls via co_freevars + AST inspection; .in_() / .like() remain allowed.
• Add tests/test_check_predicate_dialect.py with compilation, rejection, and live enforcement pins; trim test_table_checks.py rejection cases now covered by the dialect.

Closes #346

Part of #339 (parent issue stays open).

Test plan

• uv run pytest tests/test_check_predicate_dialect.py tests/test_table_checks.py
• Transfer-shaped predicates unchanged (test_table_checks.py regression)
• Live CHECK enforcement on sqlite (backend_matrix cases in new file)
• CI green on feat/table-checks base

Exit steps

• Issue closure keyword in PR body (Closes #346)
• Did not close parent feat PRD: table-level CHECK constraints (multi-column), auto-migrated #339
• Did not edit CHANGELOG.md (I-10)

Made with Cursor

[0x054]

Gate: clear

Read the full diff (checks.py lowering + tests/test_check_predicate_dialect.py + trimmed test_table_checks.py rejections). AC for #346 is met.

• >= 0 and column-to-column compile to CheckExpr::Cmp and enforce live
• .in_() / .like() lower to quoted literal tokens (no binds); .in_() also enforced live
• Enum members inline as labels ('draft')
• Closures fail at class definition; traversal / .exists() / aggregates still rejected by name
• Transfer-shaped NULL/OR predicates stay in test_table_checks.py and were not rewritten

Nits, not blocking: .like() has IR coverage but no live pin (renderer already pinned in rust); AST call inspection walks the last lambda only, so a named def predicate would skip that check (docs/examples are lambda-only; co_freevars still applies).

Merging into feat/table-checks. Does not close parent #339.