Integrate Planner evidence-dependent candidates into backend selection

[zzylol]

Why

ASAPPlanner #454 keeps constructible candidates visible when accuracy/domain, cost, or runtime-capability evidence is missing. Candidate presence is not an accuracy certificate or deployment approval. The backend currently has paths that take the first SketchAlgorithmStrategy replacement and paths that directly materialize Planner global_selection; neither is a complete evidence/policy decision for these candidates.

Work

• Consume the candidate-level unknown-accuracy and runtime-support status, symbolic ResultGuarantee, and optional candidate_cost rather than treating a PlanSpace candidate as already accepted.
• Bind each candidate to actual executor support (sketch family/parameters, exact value-operation placement, summary/window/state operations) and explicit backend policy. Unknown or disproven support must not be published as deployable.
• Scope any quantile-input-domain, Hydra shared-grid, TopK interval, distribution/cardinality, and cost evidence to the correct query/data workload and snapshot. The backend may reject a candidate when its own facts or policy do not justify it; it must not silently invent a guarantee.
• Replace first-candidate selection in control_plane/src/planner_selection.rs with an evidence-aware choice, or explicitly keep that helper demo-only. Preserve exact KeepPreAsap as an explicit fallback.
• Surface known / unknown / invalid reasons in explain output and cover no, partial, valid, invalid, and stale evidence for DDSketch ratio, Hydra, TopK, HLL/relative composition, and runtime capability. Include a workload with an explicit root AccuracyTarget.
• Coordinate cost-unavailable policy with Do not silently select raw fallback when logical candidate costs are unavailable #721 instead of treating missing numeric cost as a zero or tie.

Acceptance

For quantile_over_time(0.9,data[5m]) / quantile_over_time(0.5,data[5m]), the backend can inspect the DDSketch ratio candidate without Planner-supplied domain proof, then explicitly accept/reject it under backend policy and executor capability. The trace explains the decision. The same ownership rule applies to the other evidence-dependent families; no unproved guarantee is reported as certified and no unsupported physical operator is deployed.

Related: ProjectASAP/ASAPPlanner#454, #721.

[zzylol]

Planner-side implementation is now in ProjectASAP/ASAPPlanner#455. This issue covers the backend evidence, physical capability, selection, and explain-output integration.