feat(query): M2M existence tests — the two-hop correlation path

[0x054]

Closes #316

Stacked on #320 (slice 2/4); base retargets as the stack merges.

Slice 3/4 of the existence-tests PRD (#311, ADR-0007): .exists() on many-to-many relations, bare, scoped, and ~-negated — spelled and behaving exactly like the reverse-FK form.

What ships

User.where(lambda u: u.tags.exists(lambda tag: tag.name == "admin"))

renders

SELECT ... FROM "user"
WHERE EXISTS (SELECT 1 FROM "tag_users" AS "x1_tags"
              INNER JOIN "tag" AS "x2_tags" ON "x1_tags"."tag_id" = "x2_tags"."id"
              WHERE "x1_tags"."user_id" = "user"."id"
                AND "x2_tags"."name" = 'admin')

• The reverse-spec map learns M2M entries — join table, source column, target column, facts relationship resolution already computes on each side's descriptor (which orients the triple per side, so the declaring side and the related_name side spell identically).
• Same node, two hops. On the wire the exists node carries a two-hop correlation path: join table first (correlated to the enclosing scope), then the target. The Rust render loop from the earlier slices handles it unchanged — zero new render mechanism, which is the design claim this slice set out to prove.
• Inner lambda over the M2M target has full predicate power — operators, &/|/~, the cross-scope guard — all the feat Existence tests 2/4: scoped inner predicates — forward traversal, nesting, cross-scope guard #315 machinery, untouched.
• Hand-authored golden vector for the 2-hop path, asserted from the Python emitter and the Rust decoder; a Rust render test pins join-table-FROM, inner-join-target, and last-hop-alias qualification for the inner tree.

Acceptance criteria (#316)

• Bare, scoped, and ~-negated .exists() on an M2M relation, e2e on both backends
• Each matching root returns exactly once regardless of how many join-table rows match
• Inner lambda over the M2M target has full predicate power, matching the reverse-FK slice
• Hand-authored golden vector for the 2-hop exists path asserted by Python emitter and Rust decoder
• No new Rust render mechanism introduced — the existing hop loop covers the 2-hop path

Testing

• cargo test: 196 + 28 (ferro-schema-ir) passed, including the 2-hop render test and vector round-trip
• pytest --db-backends=sqlite,postgres: 1668 passed (full matrix, local Postgres)
• ty check and ruff check: clean

[0x054]

Superseded by #323 (slices 2–4 combined into one rebase-mergeable PR; content identical).