fix: descend all legs for requireTimeCondition (#17407) - #20441

The requireTimeCondition guard has two defects in opposite directions:

* Pre-33: joins of two bounded subqueries were rejected because
  DataSourceAnalysis.getBaseQuerySegmentSpec resolved the outer join
  query first, whose interval is ETERNITY.

* v33+: non-collapsible subquery stacks are rejected because
  ExecutionVertex.getEffectiveQuerySegmentSpec prunes at
  Query.mayCollapseQueryDataSource (default false), so the inner
  query is never visited.

Resolve the check outside ExecutionVertex with a walker that descends
every QueryDataSource and the left input of every JoinDataSource. The
right-hand input of a join is intentionally not followed (preserving
testRequireTimeConditionSemiJoinNegative), and the guard keys on query
intervals rather than filters (preserving rejection of outer __time
filters over unbounded subqueries).

Adds nine tests covering explicit joins, three-way joins, UNION ALL,
lookups on the right side of a join, non-collapsible subqueries, and
outer filters over unbounded subqueries.

…imitations)

Both testRequireTimeConditionUnionAllBothBranchesFilteredPositive and
testRequireTimeConditionUnionAllOneBranchMissingFilterNegative fail
under MSQ and Decoupled planners for reasons unrelated to the
requireTimeCondition fix:

* MSQ rejects UNION ALL between filtered scans at planning time
  ('SQL requires union between inputs that are not simple table
  scans') before NativeQueryMaker's guard runs.
* Decoupled produces a top-level UnionQuery (not a BaseQuery); the
  ~20 ExecutionVertex.of(query) callsites upstream of the analyzer
  throw 'Can't traverse a query[UnionQuery]!'.

The base-planner UNION ALL cases pass and the analyzer handles the
tree correctly — supporting UNION ALL under MSQ/Decoupled would
require orthogonal fixes to ExecutionVertexShuttle and MSQ's union
planner, out of scope for this PR.

The remaining 14 requireTimeCondition tests still cover both regression
shapes from the RCA: non-collapsible subquery stacks (v33+) and joins
of two bounded subqueries (pre-33).

…nAnalyzer

Add two regression tests for the Codex P1 raised on apache#20441:

* testJoinWithLimitWrappedUnboundedRightIsNotSatisfied — a LIMIT-wrapped
  QueryDataSource on the right leg of a join under a bounded outer scan;
  LIMIT blocks __time predicate push-down, so the inner leaf stays at
  ETERNITY. The walker must cross the join-leg boundary before reaching
  the bounded ancestor and reject.

* testNestedJoinWithDeepUnboundedLegIsNotSatisfied — a nested
  Join(FOO, Join(FOO, BAR)) under a bounded outer scan; the deepest leg
  crosses two join-leg boundaries, exercising transitive descent.

Both guard against the pre-fix behavior where
ExecutionVertex.getEffectiveQuerySegmentSpec would return the outer
interval and silently accept the unbounded inner scan.

Addresses Frank's follow-up P1 on apache#20441. The walker was returning true
for a bounded outer query over an unbounded inner QueryDataSource outside
any join-right leg, because the ancestor loop climbed past the inner
query (unbounded) and accepted the outer's bound as sufficient. The
physical table scan is actually owned by the inner query, so the outer's
bound does not reach the leaf unless the chain between leaf and outer
is fully collapsible.

Track collapsedChain while walking ancestors: for every Query past the
innermost, &= q.mayCollapseQueryDataSource(). Only accept a bounded
Query ancestor when the chain between the leaf and that ancestor has
collapsed. The innermost Query owns the leaf directly and does not need
a collapsibility check. Preserves existing behavior for
GroupBy-over-GroupBy (where mayCollapseQueryDataSource() is true) and
rejects Scan-over-Scan via QueryDataSource (where it is false).

Covered by new native test
RequireTimeConditionAnalyzerTest.testBoundedOuterOverUnboundedQueryDataSourceIsNotSatisfied.
Existing CalciteQueryTest#testRequireTimeCondition* cases unchanged.

mayCollapseQueryDataSource() is a datasource-collapse signal, not an
interval-propagation one. GroupByQuery returns true for it over a
QueryDataSource(GroupByQuery), but at runtime the inner query is executed
with its original intervals (see
GroupByQueryQueryToolChest#mergeGroupByResultsWithoutPushDown) and an
outer bound never reaches the physical scan.

Replace the ancestor-chain walk with the innermost-owning-query rule:
for each physical leaf, walk up to the first Query ancestor and check
its bound. Stop at join right-leg boundaries since the outer's spec
only applies to the primary (left) input.

Adds adversarial coverage for the follow-up P1 raised on apache#20441
(bounded outer GroupBy over ETERNITY inner GroupBy) plus five scenarios
locking down over-rejection and under-rejection edges: right leg with
its own bounded Query, 3-layer QDS with only middle bounded, bounded
inner under ETERNITY outer, and UnionDataSource with bounded/unbounded
outer.

…n error

Expose a Result record from RequireTimeConditionAnalyzer carrying the first
offending physical leaf's datasource name and its structural position
(TOP_LEVEL, NESTED_SUBQUERY, JOIN_RIGHT). NativeQueryMaker composes a
position-specific message so the user sees which table and roughly where
the __time filter is missing, instead of a single generic string.

Adds two tests exercising the CTE (WITH ... AS (...)) surface:

- testRequireTimeConditionCtePositive: a CTE that owns the __time bound in its
  definition inlines to a bounded inner subquery under the outer aggregate; the
  guard must accept it.
- testRequireTimeConditionCteNegative: a CTE with no __time filter anywhere
  inlines to an unbounded scan; the guard must reject with the "__time column"
  message.

Calcite inlines CTEs into equivalent nested subqueries (and unions when a CTE
is referenced more than once), so these shapes already map onto existing
analyzer coverage. These tests pin the SQL-layer behaviour so WITH syntax is
not an unaudited user-visible dimension.

…m recording

DecoupledPlanningCalciteQueryTest pins the native plan for this semi-join via
a frozen quidem .iq file keyed on the test's display name. Parametrising the
method made the harness look for per-config recordings
(testRequireTimeConditionPositive3@require-on.iq etc.) that don't exist,
breaking DecoupledPlanningCalciteQueryTest in CI.

Revert this one test to plain @test. The guard runs post-plan, so the matrix
adds no planner coverage here anyway. The other 8 positives stay parametrised.

… datasources

GlobalTableDataSource extends TableDataSource and remains segment-backed when
queried directly or on a join's left leg (see its javadoc). The blanket
dataSource.isGlobal() exemption at the leaf check therefore let an unbounded
scan of a broadcast datasource bypass requireTimeCondition.

Restrict the leaf-level exemption to leaves that are not instanceof
TableDataSource (lookups, inline, frame-based inline), and preserve the
right-leg broadcast-join path by short-circuiting isGlobal() leaves inside the
JOIN_RIGHT branch (where a GlobalTableDataSource is materialized via
JoinableFactory as an IndexedTable rather than scanned as segments).

Adds four analyzer-level regression tests covering direct (bounded + eternity),
left-leg under an unbounded outer, and right-leg broadcast-join cases for
GlobalTableDataSource.