feat(function): add Function v1 artifact and schema contracts

[Xuanwo]

Lance Function artifacts need a shared contract that producers, callers, and workers can validate without importing user code or consulting a catalog. Add the experimental lance-function crate to parse Function v1 descriptors, resolve OCI metadata to an exact platform manifest identity, and validate the Arrow interface.

Artifact identity hashes the original manifest bytes. Referenced manifests and configs are checked for size and digest, and selected index platform claims must agree with the image config. Image paths use container-root symlink semantics, including rejection of aliases into the worker-reserved directory.

Descriptor validation rejects duplicate JSON keys, unknown fields, unsupported versions, and unknown required capabilities. Schema validation checks individual V5 IPC messages before converting metadata to maps, preserves nested Arrow types and metadata, and rejects unknown extensions unless the caller supplies a storage/metadata validator. Schema file loading requires a caller-selected per-file byte budget, rejects oversized files before reading, and parses files one at a time; the budget does not limit decoded Arrow allocations. Scalar output requires one field; initialization requires exactly one row, including the zero-field case.

Interoperability coverage uses unchanged metadata from an independently built Docker/Skopeo image and schema bytes produced inside it by PyArrow 21. The crate is independent of catalog and execution services; layer fetching/unpacking, runtime isolation, native adapter preflight, and execution remain caller responsibilities. The format is not yet declared stable.

[lance-gatekeeper]

✅ Gate recommendation: approve.

The schema-file admission blocker is fixed. Image-backed schemas now enforce a caller-selected per-file byte budget before reading, remain bounded if a file grows during the read, and parse one file at a time.