Lambda and Variable Expressions and BoundExpressions - #9250

Adds lambdas and variables as Expression Variants and implements the scope machinery to bind them.

/// A name bound in a scope.
pub struct Variable(Arc<str>);

/// A body evaluated under a frame binding `params`.
pub struct Lambda { params: Box<[Variable]>, body: Arc<Expression> }

pub enum Expression {
    Scalar { scalar_fn: ScalarFnRef, children: Arc<Vec<Expression>> },
    Root,
    Variable(Variable),
    Lambda(Lambda),
}

pub struct Scope { root: DType, frames: Vec<Frame> }   // Frame: [(Variable, DType)]

Binding:

expr.bind_scope(&scope)                      // errors on a lambda in a value position
lambda.bind(&scope, param_dtypes)            // -> BoundLambda
scope.push_frame(frame)                      // a caller can bind names without any binder node

Design notes

A lambda is bound by whoever knows its parameter types. They come from whatever applies it, so
Lambda::bind takes them. That is the entry point a higher-order function will call with types
derived from its own arguments; here, tests call it directly.

BoundLambda is a struct, not a BoundKind variant. A lambda has no DType, and every
BoundExpression is guaranteed to have one. The function type is recorded structurally instead:
param_dtypes is the argument side, body_dtype() the result side.

Scope carries frames, not a flat map. A flat name -> dtype map cannot distinguish "this
binder's own parameter" from "a name from an enclosing binder", which is what a capture check needs.
resolve returns the dtype and the frame depth so that check is later a comparison rather than a
re-derivation.