refactor(walk): make the boundary-crossing forms the traversal primitives

[TimelordUK]

Next slice of R2, following #33.

The problem

The three transformers that must cross the subquery scope boundary — CTE hoisting, INTO removal, ILIKE -> LIKE — each hand-listed the five subquery-bearing SqlExpression variants. That arrangement compiles clean and silently stops crossing the day a sixth is added (Exists, for P3). It's the R3 failure mode precisely: #33 fixed two live bugs of exactly that shape (ILIKE inside OVER (ORDER BY ...), INTO inside a tuple IN).

The change

Invert which form is primitive. map_children_crossing / visit_children_crossing take a second closure for the nested statement; map_children is now that with an identity handler and visit_children with a no-op one. The variant list is written down once, in walk.rs — adding one is a compile error in a single place.

hoist_from_expression goes from 37 lines to 6; net −224 lines of copy-pasted match arms.

Two forced signature details

• Both closures take an explicit ctx instead of capturing. CTEHoister's recursion is &mut self, and two closures each capturing self mutably won't borrow-check — same for &mut deps on the visit path. ctx gives one mutable borrow that the helper splits across the two calls.
• f_stmt takes and returns the Box, not the statement. By value, the opaque path — most transformers — would unbox, free and realloc a large struct at every subquery. Passing the Box keeps the identity handler a genuine passthrough.

Both are documented in the module docs and the R2 entry.

Verification

Behaviour is unchanged — all three transformers already crossed the boundary; this only moves where the variants are listed. New tests pin the property the split exists to provide: the variants map_children treats as opaque must be reachable through the crossing forms, and the tuple forms must yield both their same-scope operands and their statement.

• cargo test: 685 unit tests pass; cargo fmt --check and clippy clean on the touched files
• Checked end-to-end that ILIKE inside an IN subquery still matches case-insensitively

Local Windows runs show ~21 failures in the Python/examples/history suites; all are environmental (missing .exe suffix, cp1252 decoding of the CLI's stdout, a #[cfg(unix)]-only HOME redirect) and all are green in CI. Filed separately from this work.

🤖 Generated with Claude Code