feat(join): consume numeric expression MAPs in bounded join pipelines

[justinjoy]

Fixes #1777.

The bounded JOIN -> FILTER* -> MAP eval-stack pipeline (#1475) accepted only projection MAPs. This change makes it also consume MAPs whose expressions are numeric: integer and float arithmetic and comparisons over numeric variables and literals. These expressions are pure functions of the row, with no intern, extension or session access. Each batch still goes through the ordinary col_op_map, so evaluation semantics are unchanged. String, digest, UUID, aggregate and extension expressions remain excluded. In those cases the step falls back with pipeline-not-consumable, or returns ENOTSUP in strict mode.

FILTER and MAP failures inside the pipeline used to return ENOMEM for everything. They now return the operator's own errno: ERANGE for a failed expression, matching the one-shot path, and ENOSPC for a denied admission. On failure nothing is published and the left input is restored.

Tests (tests/test_join_pipeline.c)

• Oracle match: the pipeline output equals the one-shot result on a 256-row join, and MAP only ever sees batches of at most 7 rows.

• Late ERANGE: a division by zero in a late batch returns ERANGE, the same as the oracle.

• Rollback:

  • an allocation failure injected on the fifth MAP batch;
  • the join output limit;
  • a governor budget sweep that denies admission after earlier batches were committed.

  None of these publish anything, all restore the left input, and the sweep checks that every reservation is released.

• Stale input: the pipeline falls back to the one-shot path, or returns ENOTSUP in strict mode.

• Excluded MAP: an excluded digest MAP records a fallback, or in strict mode returns ENOTSUP without being evaluated.

• Preflight cases: admitted and excluded opcodes, stack-underflow guards (one case per guard), and FILTER still rejecting arithmetic.

Validation

• meson test -C build: 432 OK, 0 failed, 14 skipped (perf and environment gates).
• test_join_pipeline is clean under ASAN/UBSAN and under TSan (-Dthreads=posix).
• Mutation checks: removing errno propagation, the unary or binary depth guards, the MAP classifier, or the arithmetic gate each fails a test. Admitting digests or arithmetic in FILTER also fails a test.
• uncrustify and clang-tidy are clean on the touched files.

Known limits (unchanged by this PR)

• With a join output limit set, an early failing row can return ERANGE where the one-shot path would first return EOVERFLOW. The pipeline counts mapped rows; the one-shot path counts join rows.
• A denied growth of the pipeline's output relation still maps to ENOMEM. This predates the PR, and in this shape MAP admission is always denied first.

Peer review: an independent reviewer did three rounds. The first round blocked a test message that could not fail. The second blocked a check message that named the wrong source of a denial. The final tree had no blocking findings.