refactor: split backend plans and bind SDS state slots

[zzylol]

Implement the backend plan split and SDS state bindings specified by #737. This PR is stacked on #737 and closes #748.

Before this PR: An installed PrecomputePlan could retain query-only nodes, backend sketch decoding depended on ASAPCollector, and writer/readout identity was implicit. For two percentile queries sharing one KLL producer, the installed artifacts did not clearly enforce one writer and two readers of the same stored state.

After this PR: PrecomputePlan contains maintenance DAGs ending at state writes; QueryPlan contains bound state reads and readouts, with the selected post-ASAP DAG kept as provenance. The Summary Catalog owns definitions, installed plans share a version-scoped state slot, and runtime inventory reports concrete instances separately from payload bytes. Publication rejects a reader whose slot or physical window disagrees with its writer. The neutral sketch codec removes the backend's ASAPCollector dependency and unsupported bare-state runtime path.

This update merges the current design and main branches, pins all Planner crates to one verified revision, follows Planner's payload-owned operator identity, and lets an installed writer assign a nonzero slot independently of its definition ID. The inventory endpoint reports that installed slot. A previously ignored ERP process test now regenerates window evidence after changing deployment target and runs in the 18-test compatibility suite.

Validation: cargo check --workspace --locked; full workspace tests with the CI controller-bin and timeout environment; ./scripts/e2e.sh whole (production controller → backend install → OTLP → PromQL); 18/18 compatibility process tests; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo fmt --all --check; and git diff --check all passed locally.