fix: null rows silently decoded as values (three validity representations dropped) + NullArray CSV export

[dfa1]

Fixes the worst finding class of the Raincloud conformance suite (#205): silent null corruption. Files written by the Python bindings (vortex-data 0.69.0) carry row validity deep in the encoding tree; our decoders flattened it away in three distinct representations, so null rows exported invented values (32.1, 0.0, …) with no error.

The three representations (all verified against the Rust reference)

1. Trailing validity child on fastlanes.bitpacked — reached through vortex.alp / vortex.zigzag / fastlanes.for, which per Rust's ValidityChild contract delegate validity to their encoded child. AlpEncodingDecoder and ZigZagEncodingDecoder now decode the child as an Array (nullability inherited from the parent dtype), split the MaskedArray, and re-wrap — the pattern FrameOfReferenceEncodingDecoder already used. BitpackedEncodingDecoder reads the trailing validity child at the index its patch shape dictates (0/2/3, mirroring the Rust vtable deserialize), failing loudly on impossible child counts.
2. Dict pool nulls — null rows are codes pointing at an invalid pool slot; slot validity is now gathered through the codes into a per-row bitmap.
3. Dict codes validity — codes carry their own validity child; propagated directly and combined with pool validity when both exist. Applied to the eager vortex.dict decoder (primitive + utf8 paths) and the lazy dict layout path.

Also closes the small one: CSV export renders all-null (DType.Null) columns as empty fields instead of throwing (#211).

Evidence

• penguins bill_length_mm/bill_depth_mm: rows 3/271 hold nulls (Python bindings read None); we exported 32.1/13.1. Fixed.
• kepler: 20k+ null cells across dozens of columns exported as values through all three representations (each fix halved the mismatch count: 54,080 → 22,299 → 10,419 → 0). kepler now passes value-for-value on all 153 columns × 9,564 rows and flips to ok in the conformance matrix.
• Full ./mvnw verify green; conformance suite 11/11.

Matrix triage after this PR: 6 ok, 4 gaps (#207, #208 ×2, #209), with #208/#209 fixes in flight on separate branches.

Closes #210
Closes #211

🤖 Generated with Claude Code

---

Note on contents: main could not be pushed directly (branch protection), so this branch also carries the two previously-committed pieces this work builds on: the Raincloud conformance harness (79453185, #205) and the lazy-dict U8/U16 fix (a9e41373, closes #206). Squash-merging this PR lands all of it.

[dfa1]

All review findings addressed:

• Findings 1–2 (deterministic tests) — d4aeed4 adds 20 CI-runnable tests: BitpackedEncodingDecoderTest (validity child at index 0/2/3 by patch shape, plain path, loud failure on impossible child counts), DictEncodingDecoderTest.RowValidity (pool-null / codes-null / combined AND / out-of-range code → VortexException), AlpEncodingDecoderTest+ZigZagEncodingDecoderTest masked-child propagation incl. the LazyConstant broadcast arm and plain-child no-regression pins, and DictLayoutDecoderTest covering the lazy gather through the public decode seam.
• Finding 3 (gap catch) — narrowed to VortexException | IndexOutOfBoundsException (the latter tied explicitly to VarBinArray.DictMode.dictReadOff: U8/U16 offset ptypes fall through to 8-byte reads — IOOBE on dict-over-fsst strings #215 and dying with its fix), 9469479.
• Finding 6 (untrusted code indexing) — pool-validity lookups guard out-of-range codes with VortexException in both dict paths, 9469479.
• Findings 7, 9 (script hardening, oracle-abort note) — 9469479.
• Findings 4–5 (per-element switch in the validity gathers) — deliberately not taken: both loops run only on the pool-null cold path, never on the green decode path; hoisting would quadruple the loop bodies for no measured benefit. Noted here per the simplify-first rule rather than silently ignored.
• Finding 8 — the flagged snake_case test names mirror the pre-existing DictLong/DictInt group conventions in the same file; left consistent with their siblings.

Full ./mvnw verify green including the new tests; conformance suite 21/21 over 20 hydrated slugs (matrix now 18 ok / 2 gaps with #208+#209 merged beneath).