Do deep agent audit/review of `stats` command

[jqnatividad]

stats is the central command of qsv.

For the 21.1.0 - release, we successfully did a Fable-powered performance refactoring that doubled its performance.

This time around - do a deep audit/review focused on edge cases using Fable - adding more test cases as required.

[jqnatividad]

Audit complete — 9 PRs merged, master green

The batched deep review of src/cmd/stats.rs is finished and entirely on master
(through 452bdfb0c). Verified after the last merge: 988 unit + 3736 integration tests,
0 failed; docs-drift-check clean.

Merged

PR	What it fixed
#4438	Batch A — panic, UB, and tempfile-leak fixes
#4439	Batch B — stats-cache validity cluster
#4441	Date renderings were coerced to 0.0 in the stats cache
#4442	Parallel stats no longer caches a partial result when a worker dies
#4443	Batch C — wrong-results cluster
#4444	The epoch date was excluded from date min/max
#4445	Never autoindex a special-format input's converted temp file
#4450	Batch D — dead field, constant drift, capacity off-by-one
#4458	record_count now comes from the compute pass, not a separate pre-pass

Edge cases that turned out to be real bugs

The audit's framing — "focused on edge cases" — was the right one; the highest-severity
findings were all reachable from ordinary data rather than contrived inputs:

• A file ending in a blank line ("...\n\n") produced wrong uniqueness_ratio,
  antimode and antimode_count, because util::count_rows() uses polars (which counts
  blank lines) while the csv reader feeding compute() skips them. The same file gave
  different statistics depending only on whether an index existed. (fix(stats): take record_count from the compute pass, not a separate pre-pass #4458)
• A compressed input plus -E was enough to trigger the partial-result cache bug —
  no contrived TOCTOU needed. (fix(stats): parallel stats no longer caches a partial result when a worker dies #4442)
• Date columns were silently coerced to 0.0 in the cache, which was degrading
  qsv schema --strict-dates in normal use. (fix(stats): date renderings are no longer coerced to 0.0 in the stats cache #4441)
• The epoch date (1970-01-01) was excluded from date min/max. (fix(stats): the epoch date is no longer excluded from date min/max #4444)

Still open

• Parallel commands break on special-format inputs when an autoindex is created (split, search, searchset) #4446 — split/search/searchset break on special-format inputs when an autoindex
  exists. Pre-existing; fails loudly. Its option (1) would also let stats parallelize
  special-format inputs again (today it falls back to sequential).
• moarstats: --pct-thresholds silently yields 0 for any percentile not in the default --percentile-list #4455 — moarstats --pct-thresholds silently yields 0 for any percentile outside the
  default --percentile-list.
• count is self-inconsistent on files with blank lines: unindexed and indexed disagree #4456 — qsv count is itself self-inconsistent on blank-line files (unindexed 3,
  indexed 2). Same polars root cause as fix(stats): take record_count from the compute pass, not a separate pre-pass #4458, but stats is now immune regardless.
• stats: skip the row-count pre-pass on unindexed files (perf; qsvlite is the main beneficiary) #4457 — the deferred perf half of the pre-pass work. Measured ceiling is only 3-8% on the
  polars build; qsvlite (~30%) is the real beneficiary, and it trades an exactly-right
  allocation hint for one that can overshoot into real RSS.

Notes for whoever picks this up next

Two things worth recording, since they cost real time here:

1. A green test suite proved nothing, twice. Both cross-boundary regressions introduced
   during this work passed the entire suite and were caught only in review. When changing
   a struct another command serializes (StatsData reaches profile's published DCAT-US v3 /
   Croissant / csvw output) or a label another command looks up, grep repo-wide for consumers —
   the compiler will not tell you.
2. Several prescribed fixes were wrong, and a couple of findings were phantoms or
   unreachable halves. Reproduce a finding before believing it, and re-verify the proposed
   remedy separately — the two failure modes are independent.

--everything is not a fixed column width (--quantile-method approx turns mad off),
so stats_headers() debug-asserts only that it never emits more than MAX_STAT_COLUMNS;
that over-large direction is deliberately unguarded and shouldn't be tightened to an equality.

[jqnatividad]

Done! Thanks Fable 5!