`feat` Cross-scope correlation in existence tests (deferred from ADR-0007)

[0x054]

Deferred by owner decision during the #307/#308 design session (2026-07-18). See ADR-0007 (docs/adr/0007-reverse-relations-tested-not-traversed.md) and the design spec (docs/plans/2026-07-18-016-existence-tests-design.md).

What is deferred

An existence test's inner lambda referencing any scope other than its own parameter — closing over the outer proxy for a correlated column-to-column comparison:

Txn.where(lambda t: t.lines.exists(lambda l: l.amount_minor == t.amount_minor))

SQL-wise this is legal (the subquery is already correlated), but it is rejected at build time in v1 with a clear error.

Why deferred

• A wire-level leaf is (column, operator, value, path) with the path implicitly scoped to the enclosing query's model — a root-referencing leaf inside an exists node is indistinguishable from a child leaf. Support needs an owner-scope marker on the leaf IR plus outer-alias qualification in the Rust render.
• It drags in a capability ferro has nowhere today: column-to-column comparison (t.a == t.b is not a supported predicate anywhere; a FieldProxy RHS is treated as a value).
• No motivating workload: every feat Reverse-relation membership predicates: EXISTS from the root query (PRD from Pinch) #307/feat OR-composition across a left-joined reverse child table (PRD from Pinch) #308 query compares child columns to literals.

Acceptance shape (when picked up)

• Owner-scope marker on leaf IR (backward-compatible addition), outer-alias qualification in the EXISTS render path.
• Column-to-column comparison as a first-class predicate (likely its own design pass — it is meaningful outside subqueries too).
• The v1 build-time rejection message updated to point here until shipped.