timely-util: page serialized edge bodies into the buffer pool - #38334

A serialized column body, the payload of `Column::Align`, is owned by
whoever holds the container. Bodies on a dataflow edge therefore belong to
no budget: they sit outside the buffer pool's ledger, so the pool's
pressure decisions cannot see them and the kernel is left to reclaim them,
faulting a Timely worker to do it. Staging measurement put their lifetime
at seconds at the median and minutes in the tail under memory pressure,
and their peak in-flight bytes above the whole pool budget.

`Column::Align` now holds an `AlignBuffer`, which is either heap words or
a pool chunk. With `enable_column_edge_paging` on and a pool installed,
serialization writes a shipped body straight into a pool slot, so the
bytes are budgeted and evictable for the interval between minting the
body and a consumer reaching it. Bodies under 64 KiB, the pool's smallest
size class, stay on the heap. `column_edge_paging_lz4` selects whether
paged bodies are stored under lz4 or identity, separately from the chunk
compression floor so the two can be measured one at a time. The
`edge_codec` bench measures the codec cost and lz4 ratio of shipped
bodies. Whether compression pays under pressure, where it trades that CPU
against swap traffic and compressed-tier residency, has not been measured,
so production stays on identity.

The pool hands out no references, so a consumer's first borrow copies the
body into a buffer of its own. Clones share the chunk: Timely clones a
body once per extra consumer at push time, and copying out there would
leave a heap body outside the budget for as long as the slowest consumer
takes. Every holder but the last reads the chunk and leaves it in the
pool, and the last one takes it, freeing it with the copy.

The state lives behind `AlignBuffer`'s `Deref` and `as_words` rather than
in a fourth `Column` variant, which would touch roughly ninety exhaustive
matches. Two facts stay resident so reading them does not materialize a
paged body: the word count, because `length_in_bytes` is on the hot path,
and the record count, because Timely calls `Accountable::record_count` at
both push and pull and it would otherwise decode the body.

A consumer's copy is allocated and freed on the consumer's thread, so
each worker keeps one retired buffer to refill on the next copy-out. It is one per thread and capped at a ship-sized body,
not one per builder, which would park an allocation in every idle
operator, the reason Timely's own container recycling is disabled.

Each buffer records the `Origin` that minted it, and
`enable_column_align_buffer_tracking` records per-origin lifetimes and
in-flight bytes as `mz_column_align_buffer_*`. In-flight bytes are heap
bytes only, since the pool already reports the paged ones. `Origin::Unpage`
tracks consumers' copies, so the round-trip cost of paging is measured
rather than inferred. Both flags are off in production and varied in the test
configuration. The paging flag also installs the pool, on the same terms
as the chunk-spill gates.

The pool singleton and both gates are process-global with no teardown,
so their tests live in their own binaries.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>