sqlgen: opt-in emission of recreate DDL for UNSAFE changes (MV recreate, engine/ORDER BY changes)

Symptom

Unsafe changes (engine swap, ORDER/PARTITION/SAMPLE BY, column storage-class switches, MV query recreation) are correctly reported via unsafeReasons (internal/loader/hcl/sqlgen.go:1101-1144) and rendered as -- UNSAFE: comments — but there is no opt-in way to actually generate the recreate DDL. For MVs the DROP+CREATE is explicitly not emitted (sqlgen.go:128-134); for storage-class column changes the MODIFY is skipped (sqlgen.go:733-734).

Impact

The operator is told "this requires recreating the table/view" and then has to hand-write the DROP+CREATE (plus data backfill) themselves. The tool knows both sides of the diff and could generate the statements.

Fix direction

Add an opt-in flag (e.g. diff -sql -emit-unsafe) that emits the recreate sequence for unsafe changes, clearly marked, instead of only the advisory comment. Default behavior unchanged.

Found in the 2026-07-02 deep-dive audit (docs/plans/2026-07-02-deep-dive-improvement-areas.md, B6).

Start in internal/loader/hcl/sqlgen.go, especially the unsafeReasons handling at lines 1101-1144 and the skipped MV and storage-class emission at lines 128-134 and 733-734. Trace the existing diff -sql path, then define how the proposed opt-in flag should emit clearly marked recreate statements while leaving default output unchanged. Done means unsafe changes produce the requested recreate sequence only with the flag.