fix(index): reject out-of-range partition ids when computing residuals

[LuciferYang]

Problem

do_compute_residual indexes the centroid buffer with the partition id straight from the batch. Ids assigned by the transformer are in range by construction, but a precomputed_partition_dataset supplies them as user data and nothing range-checks it before the slice, so an id beyond the centroid count panicked.

Fixes #9003.

What this changes

Return invalid_input naming the id and the centroid count instead of slicing.

The shuffler already does this for its own per-partition buffers (v3/shuffler.rs:600-606), but the transform chain runs before the shuffle, so for IVF_PQ the residual slice is what the id reaches first.

Test plan

test_compute_residual_rejects_out_of_range_partition passes id 5 against two centroids and asserts the variant and both numbers in the message. Without the check it panics with range start index 10 out of range for slice of length 4.

test_create_ivf_pq_rejects_out_of_range_precomputed_partition builds a real IVF_PQ index from a partitions dataset that assigns one row to partition 7 out of 2, and asserts the error rather than a panic.

• cargo test -p lance-index --lib 1231 passed, 3 ignored
• cargo test -p lance --lib index::vector::ivf::tests:: passed
• cargo clippy --all --tests --benches -- -D warnings clean
• cargo fmt --all --check clean

Not in this change

IvfShuffler, the legacy shuffler behind LANCE_LEGACY_SHUFFLER=1, indexes its partition buffers without a range check (v3/shuffler.rs:261) and would still panic on the same input. The default TwoFileShuffler path is the one that checks.

[lance-gatekeeper]

✅ Gate recommendation: approve.

The guard is at the centroid slice boundary that previously panicked, uses the actual centroid count, and preserves valid residual computation. Regression coverage exercises both the direct residual path and a full IVF_PQ build with a precomputed partition dataset.