Extraction correctness fixes: QUALIFY scope, MERGE RETURNING, tuple SET, INSERT arity, GROUP BY ordinals

[takaebato]

A batch of extraction-correctness fixes, each its own commit with regression tests. The full suite stays green (669) and the CI quartet (fmt / clippy -D warnings / test / doc -Dwarnings) is clean throughout.

Correctness fixes (wrong / missing output)

• QUALIFY phantom read — QUALIFY was bound against the FROM scope, so an output-alias reference (… AS rn … QUALIFY rn = 1) surfaced a phantom base read t.rn. Now bound against the post-projection scope like HAVING: an alias binds Derived (dropped), while a real column / inline-window key / subquery source still reads.
• MERGE RETURNING / OUTPUT dropped — MERGE … RETURNING s.b, t.c (and MSSQL OUTPUT) discarded its projected columns. The Merge node gained a returning; its select items are walked for reads + QueryOutput lineage like the other DML roots. (OUTPUT … INTO <table> and the inserted / deleted pseudo-tables remain out of scope.)
• Wildcard REPLACE (expr AS col) dropped — the replacement expression's reads / lineage were lost. Each replacement now binds as a named projection output (identical to a standalone expr AS col); bind_select_item returns Vec<NamedExpr>. The * stays unexpanded, so the output position is best-effort (documented).
• DELETE / UPDATE ORDER BY / LIMIT dropped — the MySQL DELETE … ORDER BY priority LIMIT 5 tail dropped priority. ORDER BY keys + LIMIT now bind as filter-position reads (a constant LIMIT adds none; bound for parity).
• IN (subquery) LHS lineage asymmetry — in value position a IN (list) flowed a but a IN (subquery) flowed nothing. The InSubquery LHS now flows as a value operand (a transformation), symmetric with InList; the subquery stays a filter.
• Tuple SET (a, b) = … dropped — a tuple assignment target dropped the whole assignment. It now expands to one assignment per target column: a row value pairs element-wise, a (SELECT x, y) subquery by output column (Expr::Subquery gained an output index, reusing the positional output trace — UNION-safe), with the shared subquery read once.
• Parameterized FROM function treated as a real table — generate_series(1, 10) AS g was scanned as a real table, surfacing a phantom generate_series.value base read. Now bound as an opaque table-producing factor (like UNNEST), matching the documented "table functions are opaque" contract.

Diagnostics / occurrence consistency

• Arity mismatch under-flagged — InsertColumnsArityMismatch only fired for an explicit column list against a SELECT source. Extended to VALUES rows, MERGE WHEN-INSERT, and the column-less catalog-overflow case (explicit lists flag either direction; column-less only on overflow, since a narrower source may fill the first N columns + defaults). New diagnose_insert_arity helper.
• GROUP BY 1 / ORDER BY 1 ordinals — a positional ordinal bound to an empty literal, undercounting reads vs the named form. Now resolved to the n-th output and bound by name (identity → read, introduced alias → Derived), keeping occurrence-based reads consistent.

Investigated, no change (consistent behavior)

• Normalizer literal substitution — the normalizer's contract is "every literal → ?", and it already rewrites the same literals as function args (JSON_EXTRACT path, TO_CHAR format) and as LIMIT / OFFSET. Rewriting a JSON path / CAST FORMAT / TABLESAMPLE count is consistent, not a bug. Documented the behavior neutrally; no code change.
• EXCLUDED under a Sensitive casing override — EXCLUDED is parsed as a plain identifier (not a keyword) and is PostgreSQL/SQLite-specific. Under every built-in dialect the standard alias fold already resolves it; it only degraded under an explicit with_casing(Sensitive) override, where EXCLUDED — an internal pseudo-table name matched like any identifier — behaving case-sensitively is consistent with that override. No change.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 90.68826% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.87%. Comparing base (2d14800) to head (1c503c7).

Files with missing lines	Patch %	Lines
sql-insight/src/reference.rs	86.48%	4 Missing and 1 partial ⚠️
sql-insight/src/resolver/binder/expr.rs	90.47%	4 Missing ⚠️
sql-insight/src/resolver/binder/query.rs	77.77%	4 Missing ⚠️
sql-insight/src/resolver/binder/statement.rs	96.46%	3 Missing and 1 partial ⚠️
sql-insight/src/resolver/binder.rs	86.36%	1 Missing and 2 partials ⚠️
sql-insight/src/resolver/origins.rs	75.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #35      +/-   ##
==========================================
+ Coverage   94.30%   94.87%   +0.57%     
==========================================
  Files          27       27              
  Lines        5054     5214     +160     
  Branches     5054     5214     +160     
==========================================
+ Hits         4766     4947     +181     
+ Misses        212      192      -20     
+ Partials       76       75       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.