>You still need someone to review the generated code if it throws an error for potential data loss.

Yeah, exactly what I meant by the terraform-like plan/apply stages. You generate the change script and save it as your "plan", and then have an apply step that takes a backup and runs the script.