Walk every child field of expressions when building subquery scopes

[ravenac95]

WalkInScopeIter::get_children hand-lists the child fields of most node types and leaves some out. A query in one of those fields gets no subquery scope, so its tables and columns are invisible to everything built on the scope tree:

• AggregateFunction walks only args. It skips filter, order_by and limit, and every non-typed aggregate parses to this node.
• WindowFunction skips the over.frame bounds and the keep clause.
• Cast skips format and default.
• In skips unnest.

SELECT json_agg(u.a) FILTER (WHERE u.a > (SELECT max(t.x) FROM t)) FROM u
-- before: no subquery scope, so `t` is never seen
-- after:  one Subquery scope with source `t`

What changes

• Hand-written arms that stay: only the ones that enforce scope boundaries.
  • Select: FROM and JOIN items are walked as before, and CTEs are not.
  • Table, Subquery and Exists: unchanged.
  • In: its query operand still gets its own scope through the existing In arm, so the walk leaves it out.
• Every other node takes its children from the canonical AST traversal (Expression::children()), so a field added to the AST later is covered automatically.
• Unchanged: the stop rules and the pointer dedup in collect_subqueries_in_expr, so each query still gets exactly one scope.
• Public API: walk_in_scope and find_all_in_scope now also yield nodes in the previously skipped positions. The CHANGELOG notes this.
• Out of scope: Select's own hand-listed fields (prewhere, distinct_on, windows and others). Subqueries there already got scopes through collect_subqueries. Widening what walk_in_scope yields for a Select would change what other callers see, so that's left for a separate change.

Tests

test_subquery_in_expression_field_is_one_subquery_scope checks that each position below registers exactly one subquery scope with source t, and that t doesn't leak into the outer scope:

• aggregate FILTER, both a scalar subquery and a bare ARRAY(SELECT …);
• aggregate ORDER BY;
• a window frame bound;
• CAST … FORMAT;
• Oracle CAST … DEFAULT … ON CONVERSION ERROR;
• BigQuery IN UNNEST(ARRAY(SELECT …)).

No existing expectation changed.

Local checks pass: cargo fmt --all -- --check, make check-consistency, clippy -D warnings on the ffi and wasm crates, and make test-rust-verify-core.

🤖 Generated with Claude Code

---

Generated by Claude Code