timely-util: column_pager with policy + lz4

[antiguru]

Motivation

Stacked on #36391. Layers a typed Column<C> API over mz_ore::pager with an injected policy that decides, per call, whether to keep resident, page out raw, or page out lz4-compressed. Once the pager lands, this is the seam between in-memory columnar buffers and out-of-core storage envisioned in doc/developer/design/20260504_pager.md.

Description

Adds mz_ore::pager::pageout_with for explicit-backend dispatch, bypassing the global atomic so layered consumers can route per call without racing other writers.

New mz_timely_util::column_pager module:

• PagingPolicy trait with decide(PageHint) -> PageDecision (Skip / Page { backend, codec }) and record(PageEvent) for budget bookkeeping and metrics.
• PagedColumn<C> with three variants: Resident(Column<C>, ResidentTicket), Paged { handle, meta }, and Compressed { inner, meta } (memory or pager-backed framed bytes).
• ResidentTicket is a drop guard that fires PageEvent::ResidentReleased { bytes } whether the caller calls ColumnPager::take or drops the column without taking — so policy budgets don't leak.
• ColumnPager::page drains via ContainerBytes; the Column::Align(Vec<u64>) uncompressed path moves the body Vec directly into the pager handle. Compressed path wraps the target in FrameEncoder so into_bytes streams straight through lz4 — no intermediate uncompressed Vec<u8>. Compressed File path pads to u64 alignment; the frame trailer self-delimits so no length prefix or unpad is needed on read.

Concrete TieredPolicy in column_pager::policy: each Timely worker draws from a fixed per-worker byte budget (kept in thread_local! state), spills to a process-wide shared pool when exhausted, and forces a pageout when both are full. Release returns budget to the shared pool first so other workers unblock sooner. Single-instance-per-process by construction (one shared LOCAL static); documented.

Criterion bench (cargo bench -p mz-timely-util --bench column_pager) covers 4 KiB / 256 KiB / 4 MiB × Swap / File × raw / lz4 for both round-trip and operator-loop shapes. Swap-backend results are labelled swap-warm to flag that the bench never builds enough working set to force kernel eviction; a follow-up bench under systemd-run --user --scope -p MemoryMax=... will exercise the cold path.

Checklist

• This PR has adequate test coverage / QA is not needed.
• This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
• If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
• If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).
• If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.