bin/altair db:migration-plan — proposes safe Cycle migrations from spec/entity diffs with read-only safety checks (NOT NULL backfill, unique dupes, FK orphans, type-cast, large tables) and two-phase rename/type-change plans. Deterministic JSON for agents and CI.