Unify authorized query-plane page reads

[rita-aga]

Summary

• adds ADR 0135 for the authorized OData/query-plane page contract
• replaces the phase-0 read shim with a unified query-plane read API covering native page pushdown, bounded read-source scanning, typed fallback reasons, proof/coverage telemetry, and selected/full materialization rules
• fixes row-authorized sparse reads so they either prove enough authorized rows/counts or return 413, and rechecks unsafe native candidates before counting or returning them
• wires native query pages through Turso and keeps Postgres/Turso order/null semantics aligned for supported pushdown

Validation

• cargo fmt --all -- --check
• cargo test --locked -p temper-server odata::filter_sql -- --nocapture
• cargo test --locked -p temper-server odata::query_plane_read -- --nocapture
• cargo test --locked -p temper-server odata::read_support -- --nocapture
• cargo test --locked -p temper-server --test odata_read -- --nocapture
• cargo test --locked -p temper-store-turso query_field_index_page_orders_and_limits_inside_turso -- --nocapture
• cargo test -p temper-store-postgres query_field_index_page_orders_and_limits_inside_postgres -- --nocapture
• cargo test -p temper-server --features observe projection_replay_parity_endpoint_reports_clean_bounded_scope -- --nocapture
• cargo check -p temper-server -p temper-store-postgres -p temper-store-turso
• cargo clippy -p temper-server -p temper-store-postgres -p temper-store-turso --all-targets --features observe -- -D warnings
• scripts/check-determinism.sh
• bash scripts/readability-ratchet.sh check .ci/readability-baseline.env
• git diff --check
• local live OData smoke on port 3143 for nullable order, null filter count, numeric filter count, and over-budget 413 behavior
• pre-push ALL GATES PASSED, including cargo test --workspace and doctests

Notes

• First pre-push attempt was blocked by an unhealthy local Docker daemon causing Testcontainers Postgres startup timeouts in temper_actor_runtime integration tests. After restarting Docker, that exact binary passed directly and the full pre-push suite passed.