feat: add lance_dataset_update for predicate + expression-based row updates

[LuciferYang]

Summary

Adds lance_dataset_update — the next predicate-driven mutation primitive after _delete. Callers pass an optional SQL filter (NULL = all rows) plus parallel arrays of column names and SQL value expressions. Same with_mut + block_on shape as delete, same lock semantics for in-flight scanners.

C++ wrapper: Dataset::update(predicate, vector<pair<string,string>>) -> uint64_t. Empty predicate routes to NULL on the C side. Updated row count comes back via the optional out param (NULL discards it).

Closes #32.

Error semantics

Code	When
LANCE_ERR_INVALID_ARGUMENT	NULL dataset, num_updates == 0, NULL/empty entries in columns/values, or an explicit empty predicate. Also malformed SQL filters/expressions and unknown column names — both update_where and set upstream wrap parser errors as Error::InvalidInput, so they surface as INVALID_ARGUMENT (not INTERNAL like delete). Tests pin both the predicate-side and set-side classifications.
LANCE_ERR_COMMIT_CONFLICT	Concurrent writer landed a manifest first.

Design notes

• out_num_updated is left untouched on error — every error path returns before the write. test_update_out_param_untouched_on_error locks this in with a 0xDEAD_BEEF sentinel against a boundary path (empty predicate) and an upstream-surfaced path (unknown column).
• predicate == NULL updates every row; explicit empty string is rejected so callers go through NULL rather than a parse error.
• The validation loop materializes owned (column, value) pairs up front, before taking the write lock — bad input gets a precise columns[i]/values[i] error message instead of tying up the writer.
• Mirrors lance_dataset_delete: unsafe fn, ffi_try!, with_mut(|d| block_on(...)), SAFETY comments. Arc::try_unwrap(...).unwrap_or_else(|arc| (*arc).clone()) matches what upstream Dataset::delete does internally for publishing the new dataset back into *d.

Test plan

• cargo test — 132 passed, 0 failed. 17 new update tests:
  • test_update_basic_predicate — WHERE id < 50 SET value = 99.0 on 100 rows → 50 updated; reads back the matched and unmatched rows to confirm only the matched ones changed.
  • test_update_null_predicate_updates_all — predicate == NULL, SET label = 'frozen' on 20 rows; every row reads back as 'frozen'.
  • test_update_multiple_columns — id = 7 SET value = value * 2, label = 'updated'; per-row expression evaluation.
  • test_update_no_match_returns_zero — predicate matches nothing → count = 0, dataset unchanged.
  • test_update_out_param_optional — NULL out_num_updated succeeds.
  • test_update_out_param_untouched_on_error — sentinel preserved on every error path.
  • test_update_bumps_version — version strictly increases on success.
  • Boundary validation, LANCE_ERR_INVALID_ARGUMENT: test_update_null_dataset_rejected, test_update_zero_num_updates_rejected, test_update_null_columns_rejected, test_update_null_values_rejected, test_update_empty_predicate_rejected, test_update_empty_column_entry_rejected, test_update_null_entry_in_columns_rejected.
  • Upstream-surfaced, LANCE_ERR_INVALID_ARGUMENT: test_update_invalid_predicate_rejected, test_update_unknown_column_rejected (set-side via UpdateBuilder::set), test_update_unknown_predicate_column_rejected (predicate-side via UpdateBuilder::update_where — pinned separately because it's a different upstream path).
• cargo clippy --all-targets -- -D warnings clean.
• cargo fmt --check clean.
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps clean.
• cargo test --test compile_and_run_test -- --ignored — C and C++ integration tests pass; both exercise the new wrapper end-to-end (SET name = 'frozen' against the write-roundtrip dataset, plus a num_updates == 0 rejection).

Out of scope

lance_dataset_merge_insert (upsert) is the natural follow-on — richer builder surface (when_matched / when_not_matched_insert / etc.), so it deserves its own design pass, but it'll reuse the same with_mut + block_on plumbing.

[LuciferYang]

I'll be on leave for the next few days.