[beinan]

Summary

Materializers need to decode replicated Arrow IPC without copying large binary payloads or bypassing format validation. Add an optional ipc::decode(Bytes, expected_schema) module with shared input ownership, dictionary and multi-batch support, schema/block/array-buffer checks and row/count limits. Compressed IPC and dictionary deltas remain rejected until their expansion is budgeted. Reject foreign endianness and contain Arrow metadata panics in panic-unwind builds; panic-abort builds cannot recover from dependency panics.

The component benchmark now calls this same decoder, including validation costs. Replication does not require the feature; production ingestion is not connected by this PR. Callers still reserve decoding workspace, and numeric alignment repair can allocate.

Refs #378.

Testing

• Twelve optional-module tests passed, including aligned/unaligned payload ownership, dictionary/null round trips, truncated/malformed ranges, schema mismatch, corrupt dictionary types, foreign endianness and expansion limits.
• Optional-feature release Clippy, codec correctness/allocation smoke, formatting, changed-file spelling and whitespace checks passed.
• Full repository checks passed: workspace Rust formatting, Clippy and tests; Python pytest, Ruff and Pyright.