fix: return error instead of OOM on corrupt binary page offsets

[westonpace]

Summary

• When reading a corrupt lance file where binary page offsets are non-monotonic (e.g. due to multipart upload part reordering), the subtraction val - prev in IndicesNormalizer::extend would underflow, producing a huge value used as a byte-range length, triggering an OOM allocation that kills the process.
• Use checked_sub to detect the underflow and return a descriptive error message instead, indicating the file data has been corrupted.

Context

This was discovered investigating a real-world corruption where two adjacent 5MB multipart upload parts were swapped when writing to an S3 Express directory bucket. The swapped parts caused the binary (string) column's cumulative offset indices to be non-monotonic at the part boundary, leading to the underflow.

Test plan

• Verified the fix compiles cleanly (cargo check -p lance-encoding)
• Verified against a real corrupt lance file: returns a clear error instead of OOM
• Existing tests pass

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 41.66667% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...encoding/src/previous/encodings/physical/binary.rs	41.66%	6 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!