docs(#226): implementation plan — detect-and-refuse D1 referenced-table rebuilds

4-task TDD plan: detection helper + error, renderD1 wiring, libSQL
real-engine gate (documents the failure + proves no over-refusal),
docs + CHANGELOG.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dmealing