fix(table): keep _ROW_ID predicates out of partition-key projection

[plusplusjiajia]

Purpose

_ROW_ID is not a table column, so PredicateBuilder cannot resolve it and callers hand-build the leaf with an index of their own — 0, as the existing test_with_filter_extracts_row_id_ranges does.
split_scan_predicates maps conjuncts onto partition keys by index, so on a table whose first field is a partition key, WHERE _ROW_ID >= 10 became a predicate on that key and pruned partitions by comparing them
against row ids, silently dropping rows. bucket_predicate maps by index too.

Java strips row-id conjuncts by name in DataEvolutionBatchScan.rowIdSafeResidualFilter; pypaimon's __try_parse_partition_predicate rejects a field not in partition_keys before it looks at an index. Rust was the
only implementation mapping by index with no name-level guard.

Brief change log

The guard lives in split_scan_predicates itself — the shared function that does the index mapping — so both the Paimon and Format read builders are covered, and normalize_filter strips before computing
bucket_predicate:

• strip_row_id_filter removes row-id conjuncts by name and feeds only the index-based mapping; the conjuncts are then put back unchanged, so the data side behaves as before.
• retain_row_id_filter is its exact complement, used by with_filter.
• A range from extract_row_id_ranges replaces only the conjuncts it actually represents. Extraction silently ignores what its And branch cannot convert, so _ROW_ID = 1 AND NOT(_ROW_ID = 1) still yields [1, 1]
  and the NOT has to stay.
• row_ranges_from_filter / row_ranges_pinned keep a filter-derived range from outliving the filter it came from, while a range supplied through with_row_ranges is preserved and suppresses derivation.
• strip_row_id_filter replaces remove_row_id_filter, which kept a whole Or mentioning _ROW_ID and so left the leaf in place; its tests moved across.