[datlechin]

Summary

• A save stops before anything is sent when a driver's own statement is an UPDATE or DELETE with no WHERE of its own. It names the table and keeps the queue, like the other refusals. This covers every SQL engine whose driver writes its own statements, restores included.
• SQLUnfilteredWrite (TableProSQLGrammar) decides whether a WHERE is the statement's own. A WHERE in a comment, a literal, a quoted identifier, a subquery or a bind parameter name does not count. It reads every statement in the text, one T-SQL runs without a ;, a CTE-led one, a writing CTE body, and ClickHouse's ALTER TABLE ... UPDATE/DELETE.
• Safe Mode's "DELETE with no WHERE" check now uses it. WITH ... DELETE FROM t, and a DELETE whose only WHERE sits in a subquery, now ask first. WHERE(id = 1) no longer does.
• SQL Server, Snowflake, Trino, Teradata and DynamoDB now refuse a row whose match needs a column the result did not load. Before, the match left that column out and could reach every row sharing the rest of the key. Teradata matched it as IS NULL.
• Generator tests: ClickHouse and Spanner update and delete match the row on keyed and keyless tables. Registry-only drivers get no test target (.claude/rules/tests.md, Where a test goes), so the host gate is their test.
• apple/scripts/probes/check-mysql-enum-set-save.sh saves ENUM and SET edits with the statements the save sends and reads them back. It passes on MySQL 8.4.11 and MariaDB 11.8.9.

Test plan

• RowChangeStatementFactoryUnfilteredWriteTests: a driver's UPDATE or DELETE with no WHERE, or with its only WHERE in a comment, a literal or a subquery, is refused. On main it is sent.
• SQLUnfilteredWriteTests, QueryClassifierUnfilteredDeleteTests, SpannerRowEditSQLRowMatchTests, ClickHouseDMLStatementTests, every QueryClassifier* suite and the save coverage suites.
• verify.sh plugins builds every registry plugin.
• Probe, on both servers: 17 checks pass.

Fixes #3664

Docs: TableProApp/docs#63