feat: check write inputs against the data file schema at a single boundary

[Xuanwo]

Part of #7073.

Problem

Arrow JSON input (arrow.json text) must be converted to Lance JSONB before it is encoded, but each dataset write path opted into the conversion on its own. A path that forgot it wrote UTF-8 bytes into a column whose file schema says LargeBinary + lance.json, and the file was only found to be corrupt on read (#7469–#7473 each fixed one such path). Nothing in the file writers noticed: the current-format writers (2.0–2.3) check column presence and nullability, but never compare an array's type or extension with the file schema.

Behavior

• Every current-format file writer checks each batch (and each write_column array) against the file schema before encoding. A mismatch returns Error::InvalidInput whose source is a FieldTypeMismatch naming the field path and the expected and actual Arrow type and extension. The check reads only types and field metadata, never values.
• Dataset writes convert Arrow JSON to JSONB (and top-level view arrays to offset arrays, as today) in one place: the current-format data file writer that all dataset data files now go through, including single-fragment creation and data file parts. The per-call-site conversions in the write, append, fragment-create, updater and merge-insert paths are gone.
• A Lance json field records lance.json whether it was created from arrow.json or lance.json input, so schemas derived directly from caller data match the stored layout.

Tradeoffs

• The check lives in lance-file rather than the dataset writer because it is the only layer every data file passes through (dataset writes, data file parts, and direct lance-file users), and it owns the file schema that readers trust. The conversion stays in the dataset layer: it is table semantics, and the file layer only rejects input that skipped it.
• Names and nullability of nested fields are not compared, since encoders address children by position and check nulls against values. Utf8View/BinaryView are accepted where the schema says Utf8/Binary, because the encoders already write them in the offset layout. Blob v2 fields are checked only at the struct level: the encoder receives the descriptor struct from blob preprocessing, not the struct the file schema records, and validates it itself.
• The full check runs once per writer and again only when a batch's schema differs from the last accepted one; later batches cost a pointer or schema equality check. Measured on the first batch, it adds about 0.05 µs per flat column and 0.3 µs per struct<int, json> column, which is 1–4% of encoding one flat batch and 7–13% of encoding one small nested JSON batch. That cost is paid once per file.
• write_column receives a bare array, so the column's own extension cannot be checked there; nested extensions can.
• Two write paths still convert early, because they combine caller data with values read back from storage before writing: partial-fragment merge-insert (interleave) and update_columns (hash-join fallback). They are no longer the only guard.
• Legacy (V1) files keep their existing schema compatibility check and are not changed.

[lance-gatekeeper]

✅ Gate recommendation: approve.

The indexed Utf8View append regression is fixed: normalized batches now feed both file encoding and seed observation. The added regression test passes, along with the nested JSON write-path and writer mismatch coverage.