Catch-all for classified raw SQL whose class no other rule consumes.
Classification succeeding is not the same as being judged: a raw
ALTER TABLE ... ALTER COLUMN ... TYPE ..., TRUNCATE, DROP TABLE, or a
generic ADD CONSTRAINT ... CHECK all classify cleanly and get a correct
lock/cost from Cerbero.DDL.Effects.derive/3 — but before this rule
existed, no check filtered those classes, so they produced zero findings
while unclassified_sql (which only fires when classification itself
fails) stayed silent too, since classification here succeeded.
This is the general-purpose judge for everything left over: it walks the
shared judgment spine (Cerbero.Check.Judgment, extracted from this very
module) inside the migration-local fold, so it inherits born-silencing and
the "a write-blocking-lock-taking operation is never silent" floor for free.
TRUNCATE gets an unconditional severity floor of :error regardless of
scale (destructive, irreversible — design §4) on non-born tables.
Also the judge for the two DSL operations no named rule owns —
rename table(...) and drop table(...) — both metadata-only under
ACCESS EXCLUSIVE, judged through the same generic path (lock-queue note,
traffic/scale-gated severity, born-silencing).