compute: spill correction chunk bodies through the buffer pool - #38645

`CorrectionV2::update_metrics` walked every chain and every chunk on every
operation, from four call sites including insert, so its cost grew with the
buffer: 17% of insert at 16.8M updates and rising. An `Accounting` handle,
shared by the buffer and by every structure that holds its chains, now carries
running record, size, and allocation totals, so a metrics update reads three
counters.

The totals hook the discipline the introspection logging already kept: a chain
is announced once when the buffer takes it and retired once before it is dropped
or consumed, so the totals and the logging cannot drift apart. Each chunk caches
its serialized size at construction, and each chain maintains the sum as chunks
are pushed, so no accounting step pages a chunk in.

The reported size is the logical serialized size of the bodies, resident or not.
The previous walk reported resident bytes only, which depended on what the pager
had done with each chunk since. Residency belongs to the pager, which changes it
without telling the buffer. Capacity is reported equal to size, since chunk
bodies are exactly sized when minted, and allocations count one per chunk plus
the staging vector while it holds one.

`metrics_totals_match_walk` checks the totals against a walk after inserts, a
partial drain, a since advance, and a consolidation.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…date

Every element access in `CorrectionV2` re-decoded its chunk. `Chunk::index` was
`self.column().borrow().get(i)`, and `Column::borrow` on a serialized column
rebuilds the struct-of-arrays view from the serialized header, so a k-way merge
paid O(log k) header decodes per output update: 42.7% of an insert profile,
ahead of the merge itself at 12.2%.

Borrowing is now hoisted to one view per chunk, or per chunk pair in the two-way
merge, whose inner loop runs until either cursor crosses a chunk boundary.
`Cursor` gained `chunk_handle`, `reads_from`, and `get_with` for callers that
hold a view across cursor steps. `get` and `index` remain the documented
single-access forms. Chain iteration, chunk splitting, and the time search
index a hoisted view likewise.

Holding a view inside the iterator that `updates_before` hands across the
persist writer's `await` needs the view to be `Send`, which is a new bound on
the container. The container bounds move into a `DataContainer` helper trait
so `Data` stays readable.

Insert improves 1.6x on a 4.19M-update append workload, and 2.0x under a memory
cap, where each redundant decode also faulted the header page back in.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

`CorrectionV2` paged its chunk bodies through the column pager, a separate
spill substrate with its own policy, backends, and accounting. Chunk bodies now
go to `mz_ore::pool`, which is where the rest of the codebase spills and which
accounts for its own residency. Under a 128 MiB cap with swap the pool is 1.13x
faster than the best tuned pager configuration and needs no compression to get
there, and at a 64 MiB budget it holds live RSS at a third of the unspilled
figure.

The spill decision moves into one function in `mz_timely_util::columnar::chunk`,
shared with `ColumnChunk`, so the gates, the installed pool, and the size floor
live in one place. A new `try_spill_ref` spills from a borrowed column and
encodes straight into the pool slot, so a spilled body costs no intermediate
allocation and the caller keeps its column allocation to refill. That gate is
the OR of `enable_column_paged_batcher_spill` and `enable_upsert_paged_spill`,
so the correction buffer now spills while either is on; both flags' descriptions
say so.

`ChunkBuilder` no longer wraps `ColumnBuilder`: it owns one column, mints as soon
as the column reports itself at capacity, and returns the minted chunk from
`push`, which retires the builder's pending queue. `Chunk::column` takes its body
out of the pool, freeing the slot, so a chunk holds exactly one copy of its body
at any time. A body the pool declines is serialized into an exactly sized
allocation rather than kept as a typed container, whose growth slack costs 54% of
peak RSS.

The `correction` bench gains a spill sweep, and `mz-timely-util` a
`column_borrow` bench for the per-element borrow and encode costs the design
rests on. The `correction_mem` example runs one fill per process and reads
`VmHWM` and `VmRSS`, which criterion cannot do because setup, measured closure,
and the previous iteration's drop overlap.

Co-Authored-By: Claude Fable 5.1 <[email protected]>