stack-encrypt: one match query preparation for the typed chain and the binding, and no query flag in term derivation #1319

Parent

#1279

What to build

A match query (op::Matches, a Bloom-filter text search) is refused when the index's options are unusable, when the text cannot be normalized, or when the text cuts no token, because that filter would match every row. A query that passes keeps its tokens, so verify can drop the rows the filter matched by chance.

Today this rule lives in QueryTokens::of_query. Three callers reach it on their own: the typed match Supports impl, the binding's input check (used by check_query, query_term and verify), and the binding's term derivation, behind a Use::Query flag. That flag means the write path carries a branch it never takes.

Move the match rule into a new crate-private module beneath the operators (working name op::prepare). Have the typed match impl and the binding both call it. Then remove the query branch from the binding's term derivation. After this, a match query is refused in one place, and check_query, query_term, verify and the typed chain refuse exactly the same inputs.

Acceptance criteria

• op::prepare exists, crate-private, with a match function that takes MatchOptions as a value and returns the query's QueryTokens or the refusal.
• The typed match Supports::prepare calls it after its own case check (PlanError::MatchCase), which stays typed-only.
• The binding's input check and verify call it; the binding's own match-token helper is deleted.
• The binding's term derivation no longer takes a store-or-query flag for match. Every caller that derives a query term has already prepared its input; this is confirmed for the term-by-index path behind se_term as well.
• Interface tests on the match function cover each refusal and the tokens it returns.
• The table test from the first ticket passes unchanged, as do query_operators.json and the guest's native and leak tests.
• Single-path tests that pin only a match refusal the table now covers are removed.
• cargo-mutants --in-diff leaves no surviving mutant in the changed code.

Blocked by

• stack-encrypt: replace Supports::check, verifier and admit with one prepare, called once per query #1318