feat(query): scoped existence tests — inner predicates, nesting, cross-scope guard

[0x054]

Closes #315

Stacked on #319 (slice 1/4); base retargets to main when that merges.

Slice 2/4 of the existence-tests PRD (#311, ADR-0007): the optional inner lambda, resolved as a full ferro predicate over the child model through the same validating proxy a root where() receives.

What ships

# 308: line-aware category filter; child-less roots survive the OR
Txn.where(lambda t: t.category_id.in_(ids)
                  | t.lines.exists(lambda line: line.category_id.in_(ids)))

renders

SELECT ... FROM "txn"
WHERE "txn"."category_id" IN (...)
   OR EXISTS (SELECT 1 FROM "line" AS "x1_lines"
              WHERE "x1_lines"."txn_id" = "txn"."id"
                AND "x1_lines"."category_id" IN (...))

• Full predicate power inside the test. Every operator, &/|/~ composition, forward-FK traversal, and nested existence tests to arbitrary depth. The inner lambda's explicit scope is what makes grouping unambiguous: exists(lambda l: A & B) (one child row matches both) and exists(A-test) & exists(B-test) (some child row each) are different, correct row sets — covered e2e.
• Traversal joins render INSIDE the subquery under unchanged ADR-0006 semantics (INNER at every hop, narrowing — pinned e2e by a NULL-FK child that never matches a traversed inner predicate). On the wire, the hop facts ride the exists node's own joins section (always "inner"), present only when non-empty — the bare-test bytes from slice 1 are unchanged, so no version bump.
• Nesting is recursion. A nested test's correlation hop resolves against the enclosing subquery's alias through the ExistsScope qualifier — pinned by a Rust render test ("x2_transactions"."account_id" = "x1_accounts"."id"), depth-2 e2e, and a golden vector.
• Cross-scope guard (feat Cross-scope correlation in existence tests (deferred from ADR-0007) #309). The moment inner lambdas exist, three build-time rejections land, each pointing at the deferred capability: a leaf built from any proxy other than the inner lambda's parameter (detected via a compile-side owner scope tag the proxies now stamp on comparison nodes — same-named columns can't silently rescope), a FieldProxy as comparison RHS (column-to-column), and a nested test built from another scope's proxy. Messages pinned by tests.
• Typed binds inside the subquery resolve against the leaf's owning table: the SELECT walkers populate registrations + enum catalogs for every table an existence test reaches (correlation hops, inner-join hops, nested tests, any depth).

Acceptance criteria (#315)

• Inner lambda supports every operator and &/|/~ over the child model
• Forward traversal inside the subquery renders joins within the EXISTS under ADR-0006 semantics (covered e2e)
• Nested exists-in-exists works; depth 2 pinned e2e and by a golden vector
• The feat OR-composition across a left-joined reverse child table (PRD from Pinch) #308 shape passes e2e on both backends: multi-line match → one root row; child-less root survives the OR; keyset composition
• Explicit grouping semantics covered: exists(lambda l: A & B) vs exists(A) & exists(B) return different, correct row sets
• Cross-scope reference and field-proxy-as-RHS raise build-time errors naming feat Cross-scope correlation in existence tests (deferred from ADR-0007) #309 (messages pinned by tests)
• Hand-authored golden vectors: scoped 1-hop exists, nested exists

Testing

• cargo test: 196 + 27 (ferro-schema-ir) passed, including scoped/nested render tests and both new vector round-trips
• pytest --db-backends=sqlite,postgres: 1653 passed (full matrix, local Postgres)
• ty check and ruff check: clean

[0x054]

Superseded by #323 (slices 2–4 combined into one rebase-mergeable PR per maintainer preference; content identical).