feat: add lance_dataset_alter_columns for rename / nullability / type changes

[LuciferYang]

Summary

Second of three PRs against #41. Exposes upstream's Dataset::alter_columns — rename a column, change its nullability, or change its data type, committing a new manifest. Rename and nullability-only changes are zero-copy and preserve indices on the affected column; a type change rewrites the column's data files and drops any associated indices, mirroring upstream behavior.

Mutates the dataset in place under an exclusive write lock; scanners already in flight against it keep their pre-alteration view via the existing Arc clone-on-write, same as _delete (#31) / _drop_columns (#42).

Surface

typedef enum {
    LANCE_COLUMN_NULLABLE_UNCHANGED = 0,
    LANCE_COLUMN_NULLABLE_TRUE      = 1,
    LANCE_COLUMN_NULLABLE_FALSE     = 2,
} LanceColumnNullableMode;

typedef struct LanceColumnAlteration {
    const char* path;                       /* required */
    const char* rename;                     /* NULL = keep */
    int32_t     nullable_mode;              /* LanceColumnNullableMode discriminant */
    const struct ArrowSchema* data_type;    /* NULL = keep */
} LanceColumnAlteration;

int32_t lance_dataset_alter_columns(
    LanceDataset* dataset,
    const LanceColumnAlteration* alterations,
    size_t num_alterations
);

Per-alteration validation runs up front with index-tagged error messages. The struct uses sentinels for the three optional fields (rename = NULL, nullable_mode = UNCHANGED, data_type = NULL); at least one must request a change, so a zero-init struct with only path set is rejected as a no-op rather than silently consuming a manifest version.

Two design choices worth calling out:

• nullable_mode is int32_t, not the enum directly. The struct is read across the FFI boundary, and Rust treats a #[repr(C)] enum read from C with an out-of-range discriminant as UB. So the field is int32_t and a LanceColumnNullableMode::from_raw(i32) helper converts and returns INVALID_ARGUMENT for unknown values — same pattern as merge_insert's WhenMatched::from_raw.

• data_type borrows an Arrow ArrowSchema. The wrapper never calls its release callback. Before handing the pointer to arrow-rs, the wrapper checks both release == NULL (the Arrow CADI "released" sentinel) and format == NULL (catches FFI_ArrowSchema::empty() and other half-built structs that would otherwise hit an assert! in DataType::try_from and abort the host process under panic = "abort").

The C++ wrapper takes const std::vector<lance::ColumnAlteration>& and uses the same direct-pass convention as update/merge_insert siblings — raw.data() unconditionally; an empty vector flows through the Rust-side num_alterations == 0 guard so the error message is precise.

Tests

Nineteen new Rust integration tests cover the positive paths (rename, relax / tighten nullability, Int32→Int64 upcast with value round-trip, combined rename+relax, multi-alteration per call, version bump) and the full rejection surface (NULL dataset / NULL array / zero count / NULL path / empty path / empty rename / unknown column / incompatible cast / no-op alteration with schema-unchanged assertion / invalid nullable_mode discriminant / uninitialised FFI_ArrowSchema / tightening nullability when existing rows hold NULLs).

C and C++ smoke tests slot in before test_drop_columns, relax id to nullable, and verify via ArrowSchema.flags & ARROW_FLAG_NULLABLE. Both also exercise the NULL / zero / no-op / bad-discriminant negative paths. cargo test and cargo test --test compile_and_run_test -- --ignored both green.

Follow-up

• lance_dataset_add_columns — SQL expressions / AllNulls / ArrowArrayStream

The README roadmap entry stays unticked until that lands.

[LuciferYang]

cc @jja725

[jja725]

I've been vacation and thanks for the contribution @LuciferYang

[LuciferYang]

Thank you @jja725