Fix ValuesExpression pruning dropping outer columns referenced from VALUES cells

[yvesleguennec]

Fixes #38700

SqlTreePruner.PruneValues (from #36159) copied VALUES row cells without
Visit(), so ColumnExpressions embedded in inline collections were never
registered. Outer join projections were then over-pruned (e.g. only Id
projected while EXISTS still referenced ServiceId).

Fix

• Always Visit() nested RowValues / ValuesParameter in PruneValues
  (same pattern as OpenJSON pruning)
• Fix column-name backfill to use ColumnNames[j] instead of repeating the
  first unreferenced column's name

Tests

• Relational AdHoc query filters regression for the reported scenario
• SqlServer SQL baseline asserting ServiceId remains in the join projection

Note: approach described on #38700; no maintainer reply after ~1.5 weeks, opening PR for review.

---

• I've read the guidelines for contributing and seen the walkthrough
• I've posted a comment on an issue with a detailed description of how I am planning to contribute and got approval from a member of the team
• The code builds and tests pass locally (also verified by our automated build checks)
• Commit messages follow this format:

        Summary of the changes
        - Detail 1
        - Detail 2

        Fixes #bugnumber

• Tests for the changes have been added (for bug fixes / features)
• Code follows the same patterns and style as existing code in this repo

[yvesleguennec]

@dotnet-policy-service agree

[Copilot]

Pull request overview

Fixes VALUES pruning so nested outer-column references are retained.

Changes:

• Visits VALUES cells during pruning.
• Corrects pruned column-name backfilling.
• Adds relational regression coverage and a SQL Server baseline.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/EFCore.Relational/Query/SqlTreePruner.cs	Corrects VALUES traversal and column pruning.
test/EFCore.Relational.Specification.Tests/Query/AdHocQueryFiltersQueryRelationalTestBase.cs	Adds the regression scenario.
test/EFCore.SqlServer.FunctionalTests/Query/AdHocQueryFiltersQuerySqlServerTest.cs	Verifies the generated SQL projection.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[AndriySvyryd]

Thanks for your contribution!

[jk-aau]

@AndriySvyryd Will this PR be patched into the current version (EF 10) or do we have to wait until EF 12?

[AndriySvyryd]

@jk-aau Currently the issue doesn't have enough votes (👍 reactions) to be considered for 10 or 11 backport.

[yvesleguennec]

@AndriySvyryd Following up on the backport question.

You already labeled #38700 as regression — this isn’t a new query-filter capability, it’s invalid SQL from previously-valid LINQ after 9 → 10 (#36159 / PruneValues not visiting VALUES cells). Same code, net10.0 on both sides: works on 9.0.18, throws on 10.0.0–10.0.11 (Unknown column / no such column). jk-aau hit the same hole via new[]{...}.Max() + split-query pagination after an 8 → 10.0.11 upgrade with no application changes.

We’re a .NET 10 / EF 10.0.11 production app. The issue repro is our access-control engine (new int?[] { navigation.ServiceId }.Any(...), often two navigations). On 10.x those queries fail at runtime; we had to downgrade that branch to EF 9.x (still net10.0) and cannot merge it onto our EF 10 line until this is patched. The Contains workaround only covers a single non-nullable column, not a shared IEnumerable<int?> (nullable paths, OR of several navigations, line-level service ids).

The fix is already in this PR (small Visit() + regression tests). .NET 10 is LTS — could this be considered for 10.0.x servicing on that basis, rather than vote count alone?