Faster reads: unchecked AnyList, unchecked null probe, inline accessors

[emilk]

Three hot-path follow-ups to #15 (value_unchecked iteration). Reading a validated column is the hot path — bounds are known once, so per-element re-checks are wasted work.

Changes

1. AnyList unchecked reads (any_list.rs)
AnyList only implemented value, so it inherited the trait's default value_unchecked (which forwards to the bounds-checked value). Every element of a Column<AnyList<_>> therefore re-checked bounds — the exact cost #15 removed elsewhere, but missed for the any-encoding list type. Added value_unchecked + is_null_unchecked dispatching to each concrete encoding.

2. Unchecked null probe (datatype.rs, option.rs, leaves)
New LogicalType::is_null_unchecked (safe default = is_null). Option<L>::value_unchecked read the value unchecked but still probed nullity through the bounds-checked is_null, so nullable iteration kept paying a per-element check on the validity bitmap. One helper leaf_is_null_unchecked reads the bitmap via nulls().inner().value_unchecked(); leaf encodings override it, trivial wrappers (Option, newtypes, As, duration, timestamp, Run, AnyList) forward it. Dictionary keeps its value lookup checked — a malformed key must not be UB.

3. #[inline] sweep
The crate had zero #[inline]. Added it to the per-element accessors (is_null, is_null_unchecked, value, value_unchecked, value_ref, values), TypedArray accessors, and the Column/ListValue iterator next — tiny generic forwarders crossing the quiver_types → quiver crate boundary, where inlining the wrapper chains is not guaranteed.

Safety / testing

• is_null_unchecked is unsafe (precondition index < length), covered by the existing crate-level unsafe_code rationale (updated in lib.rs).
• Soundness tests extended over sliced arrays for the new paths: nullable_string_column_sliced, any_list_column_sliced, nullable_any_list_column_sliced.
• cargo clippy --all-features --all-targets clean, full test suite green, Miri clean (no UB).

🤖 Generated with Claude Code