Fuzz harness: query-shape generation #26

Part of #22. Depends on the harness skeleton.

Widen the harness generator along the query-shape dimension. This is the highest-value dimension: #11, #19 and #21 are all query-shape bugs, and none of them needed unusual data or an unusual cache configuration.

Shapes to generate

• LIMIT / OFFSET, with and without ORDER BY. fix(reader): don't apply limit before the row filter #11 was WHERE pred LIMIT n returning zero rows. The no-ORDER BY case is the one that pushes fetch into the scan.
• Projections that do not match the filter columns. TLP violation: a cached scan returns four NULL rows in two partitions at once #19's failing query projected s while filtering on f, s and id. This shape touches the reader's selection and fallback paths and was explicitly called out as a candidate cause.
• Predicates over nested columns (struct field access). Nested-column conjuncts are silently dropped from the row filter #21's drop path. Worth generating even after the build_row_filter fix lands, as the regression guard.
• Predicates referencing columns outside the file schema — the other PushdownChecker refusal path.
• Null-sensitive predicates: IS NULL, IS NOT NULL, and self-comparisons like t.s = t.s which are NULL rather than TRUE where s is NULL. TLP violation: a cached scan returns four NULL rows in two partitions at once #19's predicate was of exactly this form.
• Conjunctions, disjunctions, NOT, BETWEEN, IN, LIKE with prefix/suffix/infix patterns.

Deferred

Joins and aggregations. They add plan surface above the scan, which is not where the bugs have been.

Acceptance

• Reverting the fix(reader): don't apply limit before the row filter #11 fix makes the harness fail within the default iteration count.
• Reverting fix(reader): keep column-free conjuncts in the row filter #20's fix makes the harness fail within the default iteration count.
• The report counts how many iterations hit each of the named shapes, and fails if a shape the suite claims to cover was never generated. Silence there would read as coverage while covering nothing.