test: Make property tests enforce witnessed outcomes

[zharinov]

The old end-to-end property tests could pass even when no query completed successfully. Rejection, NoMatch, and VM limit errors were all accepted outcomes. The tests could catch crashes, but not wrong results.

What passes now

The suite has two jobs:

• Arbitrary query or source text may be invalid, but processing must return without panicking.
• A generated valid query/source pair must compile, keep its meaning after formatting, and return the exact expected value under normal VM limits.

Expected values and byte spans come from the input generator, not from the syntax tree used by the VM. Original and formatted queries must infer the same types and return the same result.

The valid cases cover captures, repeated records, labeled alternatives, recursion, discarded results, and field predicates.

Parser bug uncovered by the formatter property

The input (("(" produced a legacy-syntax warning at the same position as its missing-closing-delimiter error. Diagnostic deduplication kept the warning and dropped the error, so the formatter received an incomplete recovery tree and hit an assertion.

EOF recovery now keeps the missing-delimiter error. Query checking rejects the input, and formatting returns FormatError::Parse.

Valid queries and result formats are unchanged.