panic: lead window function negates i64::MIN offset

[Dandandan]

Describe the bug

lead panics during planning when given i64::MIN as the offset. The implementation negates lead offsets, and negating i64::MIN overflows.

To Reproduce

EXPLAIN SELECT lead(x, -9223372036854775808) OVER (ORDER BY x)
FROM (VALUES (1)) AS t(x);

Actual behavior

thread 'main' panicked at .../library/core/src/ops/arith.rs:
attempt to negate with overflow

Expected behavior

Return a planning error for an invalid offset, not a panic.

Notes

The SQL reaches datafusion/functions-window/src/lead_lag.rs, where WindowShiftKind::Lead maps the offset through v.neg().