fix(encoding): normalize out-of-range null dictionary keys

[lance-gatefixer]

Summary

• normalize out-of-range physical dictionary keys in null slots before structural validity extraction
• preserve the zero-copy fast path for already-safe dictionaries
• cover both hand-built and Arrow-concatenated reproductions

Root cause

Arrow permits arbitrary physical keys in null dictionary slots. The structural encoder records the key validity in rep-def and then removes the Arrow null buffer, which makes those previously meaningless keys appear valid and triggers dictionary bounds validation.

Fix

When a non-empty dictionary has an out-of-range key in a null slot, rebuild only its keys from the logical iterator. This writes key zero into null slots while preserving logical nullness and dictionary values. Dictionaries without the defect remain untouched.

Validation

• cargo test -p lance-encoding test_dictionary_out_of_range_null_keys_round_trip -- --nocapture
• cargo test -p lance-encoding
• cargo fmt --all -- --check
• cargo clippy --all --tests --benches -- -D warnings

Fixes #8826

[lance-gatefixer]

Blocked: PR #8827 remains blocked at current remote head b855eca by three non-attributable stochastic vector-index checks: Rust linux-build job 98532150495 missed the randomized HNSW-PQ recall threshold at 117/256, while Python Linux 3.13 x86_64 job 98534008079 and Python Linux 3.14 ARM job 98532150478 failed residual-sample initialization with StopIteration on opposite index-version parameters. Current main 0ac7d22 is an ancestor of this head; the exact Rust failing test passes locally, both dictionary regression cases pass, and this PR changes only dictionary encoding. Rerun the three failed checks; alternatively, stabilize the unseeded vector tests in a separate change and then rerun this head.

[valkum]

These test failures look unrelated.

[lance-gatekeeper]

✅ Gate recommendation: approve.

The base merge leaves the dictionary normalization patch unchanged. The current head still repairs unsafe null-slot keys at the validity-removal boundary, and the hand-built and Arrow-concatenated round trips remain covered without changing the encoded format or safe-array allocation path.