Validate existing SQL Server tables against the Accept Family

[victorchutw]

Implements ADR-0065 (the validation logic and introspection surface). Part of the SQL Server destination cycle (map #106, sliced from #113).

Blocked by #134

Context

Every load mode that meets an existing table validates it at session begin, before any row is written. This slice builds that as an offline module: given the introspected shape of the destination table, the dataset schema, the load mode, and accept_datetime_rounding, decide acceptance — or produce the new write-phase failure incompatible_destination_table listing every violation at once. The module also owns the introspection query text and its decoding into a table-shape struct; executing it against a live server arrives with the full-refresh slice.

The contract

Per ADR-0065, a mapped column is acceptable when misfits are impossible or loud, never silent:

• Acceptable: the created shape itself (Generate SQL Server DDL and bulk rows from the dataset schema #134); the lossless widenings DATETIME2(7) and DECIMAL of wider precision at the same scale; the loud-failing narrower types INT/SMALLINT/TINYINT (overflow raises), NVARCHAR(n) (over-length raises), and DECIMAL of narrower precision at the same scale.
• Opt-in tier — exactly DATETIME and DATETIME2(p<6), admissible only under destination-level accept_datetime_rounding: true.
• Never acceptable: SMALLDATETIME, REAL/FLOAT(24), VARCHAR, DECIMAL scale mismatches, DATE, TIME, DATETIMEOFFSET.
• Nullability: a NOT NULL column cannot receive a nullable field.
• Extra table columns (outside the dataset): acceptable iff nullable, IDENTITY, or NOT NULL with a DEFAULT; an extra NOT NULL column without a default is a violation.
• Mapped IDENTITY: rejected on append and full refresh; on merge acceptable iff it is a merge key; a non-key mapped IDENTITY is rejected in every mode.
• Mapped DEFAULT-carrying column: rejected on append and full refresh when the dataset field is nullable; accepted when the field is NOT NULL or the mode is merge.
• All violations collect into one incompatible_destination_table failure listing every violation — never first-violation-only.
• Introspection: query text against the system catalog (column names, types with precision/scale/length, nullability, IDENTITY, DEFAULT presence) for [schema].[table], plus decoding into the module's struct.

Acceptance criteria

1. Table-driven unit tests cover every rule above — per mode × type family × nullability × opt-in flag — including merge's IDENTITY-key acceptance and both DEFAULT rules.
2. A multi-violation table yields a single failure listing all violations, each violation naming the column and the reason.
3. Query construction is unit-tested (schema/table quoting); the live introspection round-trip lands gated in the full-refresh slice, not here.
4. No CHANGELOG entry yet — the code and the new failure code become reachable with the first live mode, whose slice names incompatible_destination_table in its entry.

[victorchutw]

Hand-off from #134 (PR #158 → b361d6d), facts this slice should build on:

• Validation must precede every bulk_insert. The pinned tiberius fork's bulk Numeric encode arm (src/tds/codec/column_data.rs, ColumnData::Numeric with VarLenSizedPrecision) hits a todo!() when the row's scale differs from the column's scale — a panic, not an error. BulkRowPlan takes the scale from the dataset field's Arrow Decimal128(p,s), so ADR-0065's "DECIMAL scale mismatches are never acceptable" rule is what stands between a scale-mismatched table and a process abort. Run the Accept Family at session begin, before any row is sent.
• The plan is one-to-one today. BulkRowPlan::new(dataset, table_columns) in src/sqlserver.rs requires the table columns and dataset fields to match exactly, by name, once each. The extra columns ADR-0065 admits (nullable, IDENTITY, NOT NULL with DEFAULT) need their introspected column type to choose the placeholder the bulk stream carries, so the introspected table shape this slice produces should carry per-column type (with precision/scale/length), nullability, IDENTITY, and DEFAULT presence in ordinal order — enough for Land the sqlserver connector: session and full-refresh loads #136 to extend the plan with placeholder columns without a second catalog query.
• Name matching is exact and case-sensitive in the plan (Schema::index_of). Whatever this slice decides about matching against the server's case-insensitive default collation belongs to the Accept Family rules; the plan can take the table's own spelling once the rule exists.
• quote_identifier in src/sqlserver.rs (bracket quoting with ]] escaping) is reusable for the introspection query's [schema].[table].