Per-column WHERE clause for sanitization rules

[cl8dep]

Summary

The where clause on a sanitization rule applies to the entire table. It is not possible to apply different conditions per column within the same table.

Current Limitation

sanitize:
  - table: "users"
    where: "role != 'admin'"   # applies to ALL columns below
    columns:
      - name: "email"
        strategy: "faker"
        faker: "email"

If you need email sanitized for inactive users but phone sanitized for all users, you must create two separate table rules which results in two UPDATE statements and verbose config.

Proposed Approach

Allow where at the column level, taking precedence over the table-level where:

sanitize:
  - table: "users"
    columns:
      - name: "email"
        strategy: "faker"
        faker: "email"
        where: "active = false"   # column-level override
      - name: "phone"
        strategy: "faker"
        faker: "phone"
        # no where — applies to all rows

Acceptance Criteria

• where field is valid on individual column entries
• Column-level where overrides table-level where for that column
• If both are set, column-level takes precedence (not AND-combined)
• validate checks column-level where identifiers the same as table-level
• Existing table-level where behavior is unchanged