fix(scanner): do not lower a negated InList into a take

[LuciferYang]

Closes #9080.

TakeOperation::try_from_expr matched Expr::InList without consulting negated, so a filter like _rowid NOT IN (...) was planned as a take of exactly the listed ids, the complement of the predicate. The arm returns no remainder, so the predicate was dropped from the plan rather than merely ignored by the take.

Small lists never reached the lowering, because DataFusion's expression simplifier expands them into != conjunctions first. Only lists large enough to survive unexpanded hit it, which is why this is invisible in small examples.

Skipping the lowering for negated lists lets _rowid and _rowaddr run as regular scan filters, which has the right semantics: the else branch leaves expr_filter_plan untouched and hands the whole predicate to the filtered read.

_rowoffset

_rowoffset shares the arm, and the guard covers it in the sense that matters: a negated list is no longer answered as a take of the listed offsets. It cannot be answered as a scan filter either, though. _rowoffset is reachable only through this lowering, so it is absent from the filterable read schema and any predicate that survives to the planner is rejected. That is the column's existing limit rather than something the guard introduced: on main today, _rowoffset > 2 fails with Column _rowoffset does not exist from Projection::union_column, which has arms for _rowid and _rowaddr but none for _rowoffset. Adding that arm alone is not enough either; the filtered read then rejects the predicate at planner.rs:1089 with valid_fields: [idx, _rowid, _rowaddr], because the derived column is never materialized into the schema the filter is planned against.

Making every _rowoffset predicate work means requesting _rowaddr whenever a filter mentions _rowoffset and computing the derived column before filter refinement. That is a feature rather than part of this correctness fix, so it is filed as #9105. I am happy to do it there, or here if you would rather have both together.

Testing

• test_filter_to_take_with_stable_row_ids gains a ten-element _rowid NOT IN case. Against the old code it returns idx = [0..9] instead of [10, 11]. It also pins the _rowoffset contract end to end: a negated _rowoffset list must fail rather than return the complement.
• take_operation_rejects_negated_in_list exercises the lowering directly over all three columns that share the arm, so the coverage does not depend on the simplifier's expansion threshold staying where it is.

[lance-gatekeeper]

⚠️ Gate recommendation: approve with a non-blocking risk.

The guard removes the silent wrong-result path for all three system columns. _rowid and _rowaddr return the complement; _rowoffset NOT IN now fails explicitly because general _rowoffset scan filtering is not supported. #9105 tracks that bounded feature gap. An explicit error is safer than returning wrong rows, so it does not need to hold this fix.

[wjones127]

Good fix. Thank you!