expr: fix persist filter pushdown interpreter soundness bugs (PER-50)

[DAlperin]

Motivation

Fixes PER-50 (database-issues#9656): persist filter pushdown correctness violation panics.

The ColumnSpecs abstract interpreter decides whether persist filter pushdown can skip fetching a part, based on the part's column statistics. For a function marked is_monotone it samples only the endpoints of an input range and unions the results. That is sound for the function's output value, but the code trusted those two samples for more than monotonicity guarantees, and a few domain operations had gaps. Each produced a false negative: a part wrongly proven unable to match, so pushdown discards it and the runtime audit panics. Without the audit it would silently drop matching or erroring rows.

I found the first bug with a new range-based soundness proptest, then that plus an end-to-end stats→filter_result proptest surfaced the rest.

Bugs fixed (src/expr/src/interpret.rs)

• Interior fallibility. A could_error function can error on an interior input the endpoints miss (round(numeric, scale) overflows on an exponent-dependent condition, numeric::mz_timestamp rejects fractional inputs), and fallibility was read off the endpoint evaluations. A could_error function is now fallible over any multi-valued input range.
• NaN as an input bound. NaN sorts as the max of the numeric/float order but is a fixed point of monotone functions, breaking endpoint narrowing. The shortcut is skipped when a bound is NaN.
• NaN as an output. Mul/Div with an infinite operand are not corner-sampleable (inf * 0, inf / inf = NaN, and the reachable value lives in the interior, e.g. [-inf, +inf] * 0 maps both endpoints to NaN but the finite interior to 0). They fall back to the full value domain when an operand may be infinite.
• If with a null condition. eval takes the els branch on False and Null, but the interpreter mapped a null condition to fails(), dropping els. Null now takes els.
• Values::intersect of a range and a map spec. Datum order places Map between List and Numeric, so a Within range straddling those tags contains map values; intersecting it with a Nested spec returned Empty, dropping common values. It now returns the Nested side.
• The monotone-narrowing arm now treats value / null / error as orthogonal channels, so surfacing an operand's fallibility no longer collapses the value range of an enclosing monotone op.

Tests

• test_equivalence_ranges: the equivalence proptest was only ever fed single-value or unconstrained specs, so it never exercised the range narrowing production stats drive. This variant feeds genuine value_between ranges.
• gen_expr_for_relation now generates If nodes; type/function coverage widened (float, interval, int32, float arithmetic, round, temporal casts).
• test_result_spec_lattice_laws: union/intersect soundness of the abstract domain.
• filter_pushdown_audit (persist_source.rs): end-to-end proptest that builds a part from real rows, computes the real production stats, and asserts filter_result never discards a part whose MFP produces output on an actual row. This is the only layer that also catches stats-derivation bugs.
• Deterministic regressions for the numeric-NaN and interior-error cases.

Behavior change

Pushdown is now more conservative for predicates that run a column through an erroring function (arithmetic, casts, interval math): such a part is kept rather than pruned. Plain comparison filters are unaffected. The notable loss is temporal-window pruning built from interval or division arithmetic. Recovering that precisely is a follow-up: make the fallibility annotation argument-aware so, for example, col / 10 with a constant nonzero divisor stays prunable.

[antiguru]

Looks great!

[antiguru]

Might be good to leave a comment here. The line above seems to indicate that fallibility is already included in the intersect call, but that doesn't seem to be the case, and at least to me it's not clear why we need the if block.

[antiguru]

Not sure how much value we add by referencing the issue. Consider not mentioning it.