[default values] Propagate checked column-default failures

[cbb330]

Summary

Make column-default derivation failures checked end to end, with typed reasons and stored/incoming origin. Deployment-provided ColumnDefaultsSource implementations can distinguish malformed metadata, incompatible defaults, lookup outages, and internal failures without depending on an HTTP exception.

Propagate the checked failure through services/controllers to a dedicated handler, and preserve client-side Iceberg exception classifications and commit-state-unknown behavior.

Details

• Add throws ColumnDefaultException to ColumnDefaultsSource.defaults and replace the Operation-only model with Reason, Origin, and table/field/type context.
• Map invalid incoming defaults to 400, invalid stored metadata/internal errors to 500, and lookup outages to 503. Public responses contain remediation, code, requestId, and retryability rather than raw causes, schemas, or stack traces.
• Preserve deliberate fail-open GET behavior for the read bridge; writes fail closed. Avoid duplicate adapter diagnostics.
• Preserve client exception classification when extracting server message/code/requestId, including pending-manifest safety for uncertain 5xx outcomes.

This branch contains commit 182f1a9505509186fcbc26b8d38f9b8a086efd85. The checked SPI is not in the current published 0.5.499 tables artifact. Consumers require this change to be merged and released before they can update their published dependency pin; no future version number is assumed here.

Testing Done

• Compiled all 114 production Java sources in the tables module from immutable commit 182f1a95, using Java 17-compatible annotation processors and real dependency artifacts.
• Ran 90 downstream adapter/resolver/rewrite-protection tests against that isolated library through Gradle: 90 passed, 0 failed, 0 skipped. No test expectations were changed to accommodate a different local snapshot.
• The branch includes server handler, resolver, rewrite-protection, service, and Java client regression coverage.
• Full upstream build/integration CI has not been rerun locally for this PR; required upstream checks must pass before merge/publication.