feat(index): compose FRI mapping readers with planner safety boundaries

[LuQQiu]

Add the index-version-1 FRI reader behind explicit metadata dispatch. No-FRI and index-version-0 datasets continue through the existing legacy read blocks; this PR makes no scalar/vector loader changes.

Compose mapping readers along validated fragment lineage, resolve each live fragment backward to the nearest complete source coverage, and stop address translation at current live fragments. Unknown mapping paths scan; unsupported whole index versions require an upgrade.

Keep snapshot state separate from immutable cached contents: share decoded ledgers by FRI UUID and reuse unchanged mapping readers across ledger changes using content fingerprints and storage bindings. Current live fragments remain snapshot-specific. Lazily loaded counts are included in cache weights; a TODO records the cache accuracy versus latency tradeoff without adding a new interface. New label-block caching and prewarm optimizations remain later work.

Set/preserve paired FRI feature flags and validate tagged metadata against those flags before publishing a manifest. Reject unsupported maintenance. Restore follows the existing snapshot-publication path, preserving index metadata and external references; it is not blocked merely because a FRI flag is present. Clone checks share one helper and avoid reading index metadata when the flag is absent. Compaction is rejected before entering the legacy rewrite flow. Group segments by logical index before selecting usable contributors and deriving destination coverage. Drop user segments with empty query coverage. Failure to cover one destination does not discard another destination’s coverage. The batch API uses physical u64 row IDs throughout; callers can exclude superseded intermediate fragments to prevent duplicated contributions after branches reconverge. Until #9107 installs asynchronous consumers, affected index segments scan and independent segments retain their existing loading path. Dead provenance cannot receive an identity remapper just because an unknown mapping was omitted from the graph; projected legacy coverage still requires conservative lineage checks.

Validation: 31 common-reader/boundary tests and 17 existing deferred-remap regression tests pass. Tests cover concurrent cache reuse, append snapshot isolation, retained mappings after simulated pruning, changed source order/storage bindings, and cache weight growth. The historical fixture verifies legacy-reader reuse across append; pure-version-0 operations fail the test if they enter the new reader. Five transaction-level tests pin rejection of Delete, Update, CreateIndex, UpdateConfig, and MemWAL maintenance. Additional tests cover Restore, missing flags at publication, and the clone flag fast path. Formatting and workspace Clippy pass.

No format documentation changes. The core writer remains separate work.