feat(sources): rss provider phase 3/4 — freshness engine, partition-per-feed exec, table providers, catalog registration

Query surface of the RSS/Atom provider (plan Tasks 11-14):
- RssEngine: the per-feed freshness state machine (TTL hit, conditional
  revalidation, 304 re-arm, refetch, degrade-to-stale) — sole production
  consumer of egress/fetch/cache, whose dead_code allowances drop here
- RssScanExec: one partition per feed, concurrency bounded by
  max_concurrent, LIMIT gates further fetch launches after acquire, scan
  deadline degrades a partition to zero rows; reset_state overridden so
  re-execution (RecursiveQueryExec) starts clean
- feeds/items TableProviders: exact pushdown for single-feed equality,
  IN lists, and single-column equality disjunctions (what DataFusion's
  simplifier rewrites short IN lists into); pruning matches pushdown
- register_rss_tables: one source = one catalog (<name>.main.feeds /
  <name>.main.items), zero network I/O at registration; the egress
  policy is constructed in exactly one production place

Part 3 of 4 stacked PRs replacing #175 (base: rss-m1-phase2).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gracexmatin

crates/skardi/src/sources/providers/rss/egress.rs

@@ -65,14 +65,6 @@
 //! handled means adding a check inside `check_v4`/`check_v6` themselves,
 //! not changing anything about how or when they're called.
 
-// This module's only consumer today is `fetch.rs`, and `fetch.rs` in turn
-// has no production caller yet — the engine (a later PR in this stack) is
-// the first one, and hasn't landed. Until then, everything here outside of
-// this module's own tests is unreferenced from a build that excludes test
-// code, and `cargo check`/`cargo build` would otherwise flag the whole
-// file. Remove this once the engine wires `FeedFetcher` in.
-#![allow(dead_code)]
-
 use std::fmt;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
 use std::sync::Arc;