fix(clickhouse): validate coverage for every join input

[zzylol]

Why

A joined ClickHouse query could previously accept complete coverage from one summary leaf as evidence for the complete join. That could serve a result while another input was stale, incomplete, or aligned to a different pane boundary.

What

• Validate temporal coverage independently for every reachable materialized join input.
• Use each leaf's own SummaryStore result and binding window.
• Require complete query bounds, pane alignment, and the leaf-specific pane origin before local composition.
• Fall back to exact ClickHouse execution when any input fails its own coverage contract.

How

The accelerator walks the installed shared QueryPlan DAG, executes each reachable ReadMaterialization leaf separately, and checks that leaf's returned coverage against its catalog binding. Only after every leaf passes does the existing relational runtime join and project the values.

Before

Coverage from one complete summary input could mask a gap in another join input.

After

Every input must independently prove coverage for the requested interval; a stale or incomplete leaf causes fail-closed exact fallback.

Verification

• cargo fmt -p control_plane -p data_plane -- --check
• cargo check -p control_plane -p data_plane
• cargo test -p data_plane --lib asap_clickhouse_query_engine --no-fail-fast (11/11)
• MVP backend CI