Property tests for the remaining liquid array types

[zfarrell]

Part of #22. Independent of the harness children.

fuzz/ has exactly one target, covering LiquidByteViewArray<FsstArray> — roughly one of nine liquid array types. The encoding layer is not bug-free (12a05cd, "fix date squeeze"), so this gap is not skippable.

Types to cover

LiquidPrimitiveArray (and the delta variant), LiquidLinearArray, LiquidFloatArray, LiquidDecimalArray, LiquidFixedLenByteArray, SqueezedDate32Array, HybridPrimitiveArray, VariantStructSqueezedArray.

Checks per type

1. Arrow roundtrip: from_arrow_array -> to_arrow_array is identity
2. filter(selection) agrees with the Arrow filter kernel on the original array
3. eval_predicate agrees with the equivalent Arrow comparison kernel
4. to_bytes -> read_from_bytes IPC roundtrip. This is the on-disk tier's correctness path and today has only hand-written cases in src/core/src/liquid_array/ipc.rs. An encoding that survives a memory roundtrip but not a serialization roundtrip silently corrupts anything that spills to disk.

Form: seeded property tests, not libfuzzer targets

These inputs are structured — typed arrays with null masks, not byte strings. A seeded RNG inside cargo test gates every PR, runs on macOS, and reproduces from a printed seed. libfuzzer's byte-slice input model fights structured generation and needs a nightly toolchain plus a separate workflow.

Keep the existing fsst_view libfuzzer target as-is — coverage-guided mutation genuinely earns its keep on FSST string comparison, where the interesting inputs are byte-level. The generators in src/core/src/liquid_array/byte_view_array/tests.rs:431+ are a good model for the seeded style.

Acceptance

• Every type above has all four checks.
• Edge cases are generated, not just random values: empty arrays, all-null, single-element, min/max for the type, and for floats NaN, infinities, and negative zero.