Previously the FTS builder used a bespoke per-worker memory watermark
(LANCE_FTS_PARTITION_SIZE env var, default 2 GiB) to decide when to flush a
posting-list partition. Each worker tracked usage independently and flushed when it
crossed its private limit.

Changes

• Replace worker_memory_limit_bytes in IndexWorkerConfig / IndexWorker with a
  MemoryReservation drawn from a shared FairSpillPool.
• Create one FairSpillPool per build, sized to the total memory budget
  (memory_limit_mb × 1 MiB, or LANCE_FTS_PARTITION_SIZE × number of workers as
  the default), and pass it into every IndexWorker via IndexWorkerConfig.
• After each document, sync the reservation with try_grow / shrink. When
  try_grow returns Err the pool is exhausted — flush the current partition and
  free the reservation.
• Guard against a single document that is larger than the entire pool by returning an
  error when try_grow fails on an otherwise-empty builder.

Test plan

• All 25 existing builder unit tests still pass.
• New test_memory_pool_spills_on_tight_budget: constructs an IndexWorker with a
  72 KiB FairSpillPool, processes 20 docs each contributing 300 unique tokens, and
  asserts that at least one completed partition was written (proving pool-triggered
  spill occurred).

Closes #7304.