fix: four gaps loomster hit in 0.9.0: drift, sql types, apply --json, Postgres TLS (#273)

[lex00]

Closes #273

1. A column added by hand is drift. chant reports a live column past the declared ones as unclaimed fields (columns[N].*), which it doesn't count as drift. driftFromLifecycle now reads deep.unclaimed and reports each whole extra column (a group with its own name) as column <name>: declared (none), live <type>. A field src/ leaves unset on a declared column (a default) stays unclaimed, as before. Checked on Postgres and ClickHouse (yodel_273, dropped). The declarative claim's drift part adds a column by hand and expects it.
2. yodel new refreshes sql-types.d.ts. After it writes a migration from src/, when the project keeps the file, it runs chant sql types --output <that file> and says "Updated src/sql-types.d.ts". A project without the file gets none. plan and apply don't write it, and CI's chant sql types --check still catches a stale file. The templates get a types script.
3. apply --json says how to approve the plan as it is now. When the plan moves under the lock after its approval, the failed outcome now has moved (with now, the new digest), approve and chantApprove, and the text says the same. When the run is gated but chant printed no approve line, approve is made from the digest, so --json always has it. moved.now is in the schema.
4. Postgres TLS. The fix belongs in chant's connectPostgres (libpq's meaning of sslmode), and I've asked the chant session for it. docs/configuration.md now has a Postgres TLS section: uselibpqcompat=true&sslmode=require, or verify-full with RDS's CA bundle, and the RDS example uses it.

The local gate passes (844 tests). The declarative claim's new drift check hasn't run: it needs a grant (npm run grant -- declarative).