feat: cut physical candidates by lifecycle timing from one compilation

[zzylol]

Stacked on #482 (on #476, on #475).

Why

The lifecycle layer decides timing (#482), and physical compilation reads it. A
deployment should compile each query DAG once and turn each lifecycle
assignment into a cut of that compilation. Right now compile_candidate
re-lowers the whole Post-ASAP DAG for every frontier, and callers work out the
frontier from timing themselves (#482's e2e test does this in a hand-written
helper).

What

• Helper operators take their ID from their Planner node (u64::MAX - (node_id << 16) - index,
  at most one helper per node) instead of from a running counter. Every
  frontier then gives a subgraph of the same lowering, so a cut needs no
  renumbering.
• cut_candidate(&compiled, frontier) splits one compile result into the
  precompute and query DAGs of a PhysicalCandidate. Nothing is lowered again.
• New frontier_from_timing(&PostAsapDag) -> Result<Vec<NodeId>> finds the
  frontier in a timed DAG from execution_timed_dag: the ingestion-time nodes
  that query-time nodes read, plus the root if it runs at ingestion time. It
  rejects a DAG where a query-time node feeds an ingestion-time node. It is
  public because the deployment owns the compile/cut loop and needs this
  mapping. Without it, every caller writes its own copy of the rule.
• enumerate_compiled_frontiers is no longer public. Placement now comes from
  lifecycle timing, so the only callers were enumerate_frontiers and tests.
• compile_candidates lowers once and cuts once per frontier.
• In feat: derive execution timing from a summary lifecycle plan #482's e2e test, frontier_from_timing replaces the hand-written frontier
  helper.

Before this PR

let dag = plan.execution_timed_dag()?;
let frontier = /* caller-derived from timing */;
compile_candidate(&dag, inputs, &roots, &frontier)?;      // re-lowers per assignment

After this PR

let compiled = compile(&dag, inputs, &roots)?;            // lowers once
for plan in lifecycle_plans {
    let frontier = frontier_from_timing(&plan.execution_timed_dag()?)?;
    let candidate = cut_candidate(&compiled, &frontier)?; // partitions only
}

For quantile(0.99, latency) and sum by(job)(rate(m[1m])), the
ContinuouslyMaintained frontier is the retained state and the Ephemeral
frontier is empty. Both cuts come from one compilation.

Compatibility

• Helper operator IDs are now u64::MAX - (node_id << 16) - index. Encoded physical DAGs that
  contain helpers are different byte for byte from before, so fixtures or
  quotes that embed them must be regenerated.
• An ingestion-time Binary lowers differently from a query-time one. For that
  node, the timing at compile time must match the assignment being cut. This
  is documented on frontier_from_timing.
• Temporal pane candidates still use their own lowering.

Validation

• summary_maintenance_lifecycle_e2e::lifecycle_timing_cuts_one_compilation:
  covers the KLL quantile fixture and grouped Rate→Sum. One compilation of the
  Ephemeral-timed DAG is cut by both the ContinuouslyMaintained and the
  Ephemeral timed DAGs. Each cut serializes byte for byte like
  compile_candidate on that timed DAG, and each frontier is the expected one.
• Unit tests in physical_planner::candidates: across two timings, each
  Planner node is lowered exactly once (counted) and both cuts match
  compile_candidate. An ingestion-time root is the frontier. A query-time node
  feeding an ingestion-time node is rejected.
• precompute_candidates.rs: every enumerated frontier cuts to the same bytes
  as per-frontier recompilation. The top-k Sort helper is u64::MAX - root
  and is rejected as a boundary.
• cargo fmt --check and cargo clippy --workspace --all-targets -- -D warnings
  pass. cargo test --workspace --no-fail-fast: 1378 passed, 0 failed.

🤖 Generated with Claude Code