Reject lake ON CONFLICT queries

[bill-ph]

Summary

Duckgres now rejects INSERT ... ON CONFLICT ... on constraint-less lake catalogs instead of rewriting it to MERGE.

The longer-term alternative is implementing UNIQUE / PRIMARY KEY enforcement in DuckLake. That has meaningful tradeoffs: extra metadata or indexing, slower writes, more complex concurrent commits/retries, and a cleanup story for tables that already contain duplicates. This PR takes the smaller Duckgres-side path: fail fast when PostgreSQL conflict semantics cannot be honored.

What It Fixes

Prevents lake-backed ON CONFLICT DO UPDATE statements from being emulated in a way that can fan out over duplicate source or target keys when uniqueness is not enforced.

Behavior

• Rejects all lake-catalog INSERT ... ON CONFLICT ... forms with 0A000.
• Includes DO UPDATE, DO NOTHING, INSERT ... SELECT, ON CONSTRAINT, expression/partial targets, and targetless DO NOTHING.
• Also catches nested writable CTE forms before they can be rewritten into multi-statement SQL.
• Leaves non-lake/default DuckDB ON CONFLICT pass-through behavior unchanged.

Not Fixed

• Does not remove existing duplicate rows.
• Does not implement uniqueness in DuckLake.
• Does not protect plain INSERT, COPY, direct MERGE, or non-Duckgres writers.

Tests

• go test ./transpiler ./transpiler/transform -run 'OnConflict|FeatureNotSupported'
• go test ./transpiler ./transpiler/transform -run 'OnConflict|FeatureNotSupported|WritableCTE|Walk'
• go test -count=1 ./transpiler ./transpiler/transform ./transpiler/backend
• go test -count=1 -run TestDMLInsertOnConflict ./tests/integration
• go test -run '^$' ./tests/integration
• go test -count=1 -run '^$' ./tests/integration
• just lint

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	0	3	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +4 / -0
• Assertions: +30 / -1
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.