feat(transaction): implement the index management actions

[wjones127]

Stacked on #8554. Implements the three index-management actions the Transaction V2 draft left unwritten: AddIndexSegment, RemoveIndexSegment, and AdjustIndexCoverage, plus the lowering of the legacy CreateIndex operation onto them.

The format has no first-class "index" separate from its segments — a logical index is the set of segments sharing a name — so the actions operate on segments. Creating an index and extending one are the same action; dropping an index is one removal per segment. Because a segment's fields, coverage, and base path are all Refs, one commit can now append data and index what it just appended, which previously took two versions.

Example

Appending a fragment and covering it with a new index segment, in one atomic commit — the index names the fragment by the token it was minted under, since the fragment has no id until the commit lands:

CompositeOperation::new(vec![UserAction::new("append and index", vec![
    Action::AddFragment(AddFragment { local: 0, physical_rows: 5, .. }),
    Action::AddDataFile(AddDataFile { fragment: Ref::Local(0), file, .. }),
    Action::AddIndexSegment(AddIndexSegment {
        name: "by_a".into(),
        covered_fragments: Some(vec![Ref::Committed(0), Ref::Local(0)]),
        ..
    }),
])])

Breaking changes

Three changes to AddIndexSegment in the (unstable, pre-vote) draft wire format:

• covered_fragments becomes an optional wrapper message rather than a bare repeated. A bare repeated field cannot distinguish "no coverage recorded" — what the MemWAL and fragment-reuse indices carry, and what the query path treats as "serve this segment" — from "covers no fragment", which it treats as "skip it". Collapsing the two would silently change which segments answer a query.
• Added base, without which a segment imported from another dataset cannot be expressed at all.
• Added created_at and dataset_version. Both describe the build rather than where it lands, so replaying the action onto a different version must not rewrite them. dataset_version in particular is a correctness gate rather than provenance: an overlay committed at or before it counts as already folded into the index, and a segment merged from several older ones reflects only as much as its oldest input. That puts it genuinely below the version the operation reads, so it cannot be derived. It defaults to the read version and may not exceed it.

Per the plan for this stack, these get folded into the first PR at the end so the format change is a single vote.

Not included

AdjustIndexCoverage keeps the shape the draft gave it, including the note that coverage representation is still an open design area. It rejects a segment that records no coverage rather than treating "unknown" as an empty set to add to.

The remaining drafted actions (AddOverlays, RefreshRowVersionMetadata, UpdateCompactedSsTables, AssertUniqueKeys) are still unimplemented and still rejected on load.

Behavior differences from the legacy path

The CreateIndex lowering is verified by building the same manifest both ways and asserting the resulting index metadata is identical, but two edges the legacy path silently tolerates are rejected here: removing a segment the manifest does not have, and adding one whose uuid an existing segment already uses. Either means the operation was planned against a different set of segments than it is landing on.

[github-actions]

Important

This PR touches the Lance format specification.

Substantive changes to the format specification — the .proto definitions
and the spec docs under docs/src/format/ — require a PMC vote before merge.
Minor edits such as typo fixes, wording, or formatting are excluded; use your
judgment.

If this is a meaningful format change:

• Start a vote following the Lance community voting process.
  Format specification modifications need 3 binding +1 votes (excluding the
  proposer), held on GitHub Discussions, with a minimum voting period of 1 week.
• Once the vote passes, link the completed vote in this PR. It should not be
  merged until the vote is linked.

[wjones127]

issue(blocking): I don't see why we wouldn't allow multiple segments to be committed to the same index, as long as they have matching index config and cover disjoint fragments. However, I don't know if we can express that with footprint. Something we need to discuss.

[wjones127]

Superseded by #8645, which folds this together with #8641 (the index claim conflict rule) and moves the branch head into this repo for GitHub's native stacks. The protobuf changes described here now live in #7954.