repr: reject corrupt proto shapes and out-of-domain type modifiers when decoding

[def-]

Four fixes to mz-repr's proto decoding. from_proto is a trust boundary for
durable catalog state and for the compute/storage protocol, so every one of
these is reachable from a corrupt or forged message, and each produced a value
that no SQL statement could have built.

• Type-modifier domains were not enforced. CharLength,
  VarCharMaxLength, NumericMaxScale and TimestampPrecision each have a
  TryFrom<i64> that rejects out-of-domain values, but their from_proto
  copied the wire value straight through. Consumers rely on the invariant being
  real, since a TimestampPrecision above MAX_PRECISION panics
  round_to_precision. All four now route through TryFrom<i64> and surface
  the rejection as an InvalidFieldError.

  The Arbitrary impls are narrowed to the same domains, which the validation
  makes load-bearing. CharLength and VarCharMaxLength mapped an arbitrary
  u32 through % 300, so they generated 0, and there is no char(0) or
  varchar(0). NumericMaxScale and TimestampPrecision used
  derive(Arbitrary), which knows nothing of NUMERIC_DATUM_MAX_PRECISION or
  MAX_PRECISION.

• Corrupt ProtoRelationDesc shapes were accepted.
  VersionedRelationDesc::validate treats a names/column-types length mismatch
  and an out-of-bounds key column index as corruption, but
  RelationDesc::from_proto accepted both, and nothing downstream catches them:
  such a desc decodes and re-encodes cleanly and only panics at first use,
  iter() indexing typ.columns()[typ_idx] out of bounds or into_iter()
  tripping zip_eq.

  This commit also records why only dense descs may be handed to
  Codec::encode_schema: ProtoRelationDesc has no field for the
  ColumnIndex keys, only the values in ColumnIndex order, so a sparse desc
  comes back from from_proto renumbered to 0..n. Since
  ColumnIndex::to_stable_name is the arrow field name that
  RowColumnarEncoder and RowColumnarDecoder agree on, encoding a sparse desc
  as the schema of data written under the original indexes builds a decoder that
  looks up the wrong fields.

• validate miscounted versions for a dropped non-root column. It derived
  each column's versions with dropped.unwrap_or(added), discarding the add's
  version whenever a column was also dropped. Every version past the root is
  stamped exactly once, so a column added after the root and later dropped
  accounts for two and both must be counted. Collapsing them rejected any desc
  where a non-root column was later dropped.

• ProtoNumeric.bcd was unbounded before the BCD FFI.
  decPackedToNumber writes one BCD digit per input nibble into the coefficient
  of the decNumber it is handed, without checking the coefficient can hold
  them.

Tests

Each fix comes with a red test that fails without it. The
relation_desc_proto_roundtrip, scalar_type_proto_roundtrip and
column_type_proto_roundtrip cargo-fuzz targets cover this area and are
sharpened in #37979, which should land after this.

Note for reviewers: src/storage-types/src/snapshots/source-datas.txt, the
SourceData serialization-stability corpus, was itself generated by the old wide
strategies. 10 of its 40 entries carry a numeric max scale or timestamp
precision outside the domain, so from_proto now refuses them. Those 10 are
regenerated from the narrowed strategies, and the other 30 are byte-identical.
The encoding is untouched, so MINIMUM_CONSOLIDATED_VERSION does not move.