Make extension codecs composable

[timsaucer]

Which issue does this PR close?

Part 2 of 3 in the split of #1672. These are enabled as a github stack so you should be able to swab between the 3 PRs in github interface (above, next to the "Open" oval).

Rationale for this change

Supporting a foreign planner surfaced a codec problem: a query can involve three independent native libraries (datafusion-python, a provider library, and a planner library), and each library needs its extension codecs active on the session at the same time. Previously, installing a logical or physical extension codec replaced the prior codec, so the second library's install silently discarded the first — plans then failed later with a confusing decode error.

What changes are included in this PR?

• with_logical_extension_codec / with_physical_extension_codec now prepend to a codec chain instead of replacing the prior codec. The most recently installed codec is consulted first, falling through codec by codec to DataFusion's default codec. A codec signals "not mine" by returning an error.
• Encoding runs each codec against a scratch buffer so failed attempts leave no partial bytes, and treats Ok-with-no-bytes (encode by name) as "no opinion" so later codecs still get a chance.
• When every codec in the chain fails, the errors are aggregated so the owning codec's diagnostic is not masked by the default codec's generic error.
• Fixed a latent bug where installing a codec silently reset python_udf_inlining back to enabled.
• docs/source/contributor-guide/ffi.md gains sections on composable codecs: family-prefix discipline, and that registration order between libraries no longer matters.

Test coverage

The chain behavior was originally covered by two #[cfg(test)] modules in crates/core/src/codec.rs. Those tests never ran: no workflow invokes cargo test, and the only Rust checks are cargo fmt --check and cargo clippy --no-deps --all-targets. --all-targets compiles test code, so the tests could not rot into a non-compiling state, but a behavioral regression would not have failed the build. Adding a cargo test job is also not a one-line change, because crates/core/Cargo.toml enables pyo3/extension-module unconditionally and the test binary therefore fails to link against Py_* on Linux. The coverage was moved to pytest instead, matching this repository's practice of treating the user-facing Python surface as the primary focus.

• Both Rust test modules are removed. Five of the eighteen cases were already covered by existing pytest cases, and one (strip_errors_on_too_old_version) asserted nothing because WIRE_VERSION_MIN_SUPPORTED equals WIRE_VERSION_CURRENT.
• python/tests/test_pickle_expr.py gains coverage for the wire-header diagnostics — an unsupported wire-format version and a Python major-version mismatch — by patching the header in place inside the encoded protobuf. The patches preserve length so the outer message stays parseable and the bytes reach the codec.
• The FFI example suite gains coverage for the chain itself, exercised across a real FFI boundary: encode ordering, decode fall-through to an earlier-installed codec, the aggregated multi-codec error, the verbatim single-codec error, and preservation of python_udf_inlining across a codec install.
• Three cases were dropped rather than ported. They truncate the wire header, which changes the payload length and breaks the enclosing protobuf framing, so they cannot reach the header check from Python.
• The inlining test asserts encode and decode behavior rather than the python_udf_inlining() accessor the Rust test checked. This is a stronger assertion: a codec exported from another SessionContext is itself a Python-aware codec with inlining enabled, so the strict outer codec delegates to it and the inline payload reappears even though the accessor still reports strict. The test uses an extension codec that delegates UDF encoding to DataFusion's default codec, which is the realistic case.
• AGENTS.md records the Python-first testing preference and the fact that CI does not run Rust tests, so the tradeoff does not have to be rediscovered.

Are there any user-facing changes?

Behavior change: installing an extension codec now composes with previously installed codecs instead of replacing them. Code that relied on replacement semantics (installing a codec to remove a prior one) is affected; all other usage keeps working and no longer loses earlier codecs.

No change to the published datafusion package beyond the above. MyLogicalExtensionCodec in examples/datafusion-ffi-example gains an optional token argument that overrides the byte prefix it stamps on encoded table providers, which is what lets the tests install two instances owning disjoint slices of the wire format. It defaults to the previous constant, so existing call sites are unchanged, and the example README notes that real plugin libraries should hard-code a prefix unique to the library rather than accept one from the caller.