feat(format): add IndexMetadata.covering_fields for covering indexes

[vivek-bharathan]

Adds repeated int32 covering_fields = 11 -- the columns an index stores
alongside its own data so a covered query can skip the base-table take. These
columns are listed in fields too, as its trailing entries. fields answers
what invalidates the index; the keyed prefix,
fields.len() - covering_fields.len(), answers what it can serve.

Nothing populates the field yet; the creation API follows separately.

Note: this is additive on the wire. Field 11 is ignored by readers that predate
it, and manifests written before it decode to an empty declaration

[github-actions]

Important

This PR touches the Lance format specification.

Substantive changes to the format specification — the .proto definitions
and the spec docs under docs/src/format/ — require a PMC vote before merge.
Minor edits such as typo fixes, wording, or formatting are excluded; use your
judgment.

If this is a meaningful format change:

• Start a vote following the Lance community voting process.
  Format specification modifications need 3 binding +1 votes (excluding the
  proposer), held on GitHub Discussions, with a minimum voting period of 1 week.
• Once the vote passes, link the completed vote in this PR. It should not be
  merged until the vote is linked.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

ACTION NEEDED
Lance follows the Conventional Commits specification for release automation.

The PR title and description are used as the merge commit message. Please update your PR title and description to match the specification.

For details on the error please inspect the "PR Title Check" action.

[lance-gatekeeper]

⚠️ Gate recommendation: approve with a non-blocking risk.

The documentation now makes explicit that carried columns participate in fragment invalidation and overlay staleness masking. That matches the existing full-fields dependency contract, and the non-documentation implementation is unchanged from the previously reviewed revision.

The preview-release risk is unchanged: v11.0.0-beta.4 through beta.17 treated reclaimed bit 128 as the retired MemWAL flag, so those builds can open a newly covered dataset and misread carried fields as keyed or erase the new declaration on rewrite. Keeping bit 256 would avoid that exposure, but preview releases explicitly carry no stability guarantee, so no further change is requested here.

[jackye1995]

Looks good to me!

[jackye1995]

The vote has passed, merging!