fix(l2): drop provably-absent outer group keys (#53); pin + document the #27 nesting contract

[zzylol]

Closes #53. Also finishes the remaining in-scope checklist items of #27 (details below).

#53 — decision: fix, not WAI-rejection

sum(sum by (group)(http_requests{job="api-server"})) by (job) is valid PromQL: aggregating by a label that no input series carries puts every series in one group and omits the (empty) label from the output. Prometheus evaluates it; we rejected it with column job not found in schema (have: ["group", "sum"]).

The fix is the new resolve_group_keys_promql in asap-l2::column_resolution: a group key that fails to resolve against a closed schema is dropped rather than rejected. Closure is what makes this exact rather than permissive — the inner cross-series aggregate enumerated its output columns, so the label's absence is provable at plan time, grouping by it is the identity partition, and dropping it reproduces Prometheus's output labels precisely. Two guardrails:

• Open schemas keep the strict error. The Binder seeds every referenced label onto PromQL leaves, so an unresolved key over an open schema is a resolution bug, not an absent label — it must keep surfacing.
• SQL is untouched. The helper is wired only into the PromQL single-stat aggregate branch of the shared converter; SQL GROUP BY still resolves through the strict resolve_column_refs (and DataFusion has validated the columns before we ever see them).

Pinned at three levels: resolver unit tests (closed drops / open errors / present keys keep positions), conformance tests (the repro lowers with the key dropped; a key that IS present in the nested aggregate's output still resolves positionally), and an exact-tree e2e pin of the repro query (q53_outer_group_key_absent_from_nested_aggregate).

#27 — the two remaining in-scope checklist items

1. SQL scalar / IN / EXISTS subqueries in predicates — the open question is now decided and pinned: reject cleanly in v1, for the whole family. Scalar (x > (SELECT …)) and IN (SELECT …) were already rejected with pinned tests; this adds exists_subquery_in_predicate_is_rejected covering correlated EXISTS, NOT EXISTS, and NOT IN, so no shape in the family can start silently mislowering. (Representing them needs a subquery node in the L2 expression IR + a correlated-vs-uncorrelated choice; derived tables in FROM remain the supported SQL nesting shape.)
2. Document the nesting contract — docs/promql-lowering.md gains a "The nesting contract (issue Support nested query functions for PromQL and SQL (testing + implementation) #27)" section: a lowers-vs-rejected table of composite argument shapes (aggregate-over-aggregate, aggregate-over-binary-op, generic vs heavy-hitter top-k, range functions over sub-queries, the L3: nested aggregate drops outer group key (sum(sum by (k)(...)) by (j)) — decide WAI vs fix #53 absent-key semantics, SQL derived tables; vs unary negation Unary negation rejected in PromQL lowering (no scalar/negate node) #36, without(...) PromQL without(...) grouping unsupported — usage-derived schema can't enumerate the complement #39, predicate subqueries), every row citing the test that pins it.

After this, every #27 checklist item is either done or tracked by its own dedicated issue (#36 unary negation — the last one standing, since #35 landed), so #27 can be closed as a tracking issue if you agree.

Note: this PR does not touch asap-plan/asap-sketch, so it is independent of open PR #100.

Verified: cargo test --workspace — 0 failures (334 tests; 8 new); cargo clippy --all-targets clean; cargo fmt --check diff count identical to main's pre-existing baseline (113 — no new formatting drift).

🤖 Generated with Claude Code