fix(opt): correct multi-conjunct HAVING over GROUP (AND-split bug)

[singaraiona]

Summary

A multi-conjunct HAVING predicate over a GROUP (e.g. HAVING (sum v) > 10 AND (max v) < 30) returned a schema error (or row-count mismatch) on the default-optimized plan. This is a pre-existing correctness defect on master, previously papered over by tests that executed only the un-optimized baseline.

Root cause: pass_filter_reorder → split_and_filter rewrites FILTER(AND(a,b), GROUP) into a chain FILTER(b, FILTER(a, GROUP)). The executor's HAVING fusion (exec.c) swaps g->table to the GROUP output only when a filter's direct child is OP_GROUP — so in the chain, the outer conjunct evaluates against the base table, which lacks the aggregate-output columns (→ schema error) or has a different row count (→ mismatch).

Fix: one guard in split_and_filter — don't split a filter whose data input is a GROUP. The intact FILTER(AND, GROUP) is then handled correctly by the existing single-level HAVING fusion. This is zero-cost: a filter directly over GROUP feeds on the (small) group output with nothing useful to reorder past, and key-predicate pushdown below GROUP is handled by a separate pass. The guard's direct-child condition is exactly aligned with the fusion's, so coverage matches precisely.

Triggers fixed (all on default optimization, no knobs): AND(agg, agg), AND(key, agg), and AND(key, key) with pushdown disabled.

Test Plan

• New group_pushdown/having_and_agg_exec — AND(agg,agg) over GROUP executes the optimized plan, asserts un-split shape + 2 rows (no coverage before).
• New group_pushdown/and_split_non_group — pins guard narrowness: a non-GROUP FILTER(AND) still splits.
• group_pushdown/no_push_mixed_pred flipped from baseline-only to executing the optimized AND(key,agg) plan.
• group_pushdown/diff_and_of_keys — stale "row-count mismatch" comment corrected; added a disabled-pushdown assertion proving the previously-documented failure now executes (knob restored before asserts, no cross-test leak).
• Full suite green under ASan+UBSan (0 failed); group_pushdown 18/18; opt/filter reorder suites green.

Correctness-only change — no perf gate (removes a broken, benefit-free split in one case; the common path is byte-untouched).