Window result columns bypass query_memory_limit #761

Problem

Window::finish materializes every window result as Vec<Vec<Value>> by calling windows(&self.find, &values, ...) while the input named-variable values are still held. The returned columns are not charged to the query's Held meter. held_values is then released before each result is converted to a Cell and charged to held. See src/query/engine/window.rs around finish().

For windows returning large values (for example min/max of long strings or sets, and lag/lead after #182), a query can retain roughly another result column's worth of values per window beyond OpenOptions::query_memory_limit without returning QRY-012. The same temporary allocation also uses infallible Vec growth in datalog::aggregate::windows.

Expected

The retained result columns should count toward the Window operator's query memory limit while they coexist with the input and output rows. Allocation refusal should return QRY-012, consistent with other held operator state. A regression test should use a tight limit and large values across multiple window columns.

This was found during the #182 final review; the gap exists for earlier window functions too. It does not change query answers or stored data.