feat: upgrade to ggsql 0.5.2 with native SVG/PDF/HEP writers

[cpsievert]

Summary

Upgrades the Python bindings from ggsql Rust crate v0.3.3 to v0.5.2, and exposes the crate's new native rendering capabilities in Python. Upstream 0.4.0–0.5.2 brings many ggsql language and rendering improvements — see the crate changelog for details.

High-level impact:

• Native rendering, no JavaScript: new SVGWriter, PDFWriter, and HepWriter classes render Specs directly via ggsql's native renderer (hephaestus). render() returns str (SVG) or bytes (PDF/HEP), and render warnings are surfaced via warnings.warn().
• One-call file export: new ggsql.save(spec, file, ...) helper picks the writer from the file extension (.svg, .pdf, .hep, or .json for Vega-Lite).
• Builtin datasets: the crate's builtin-data feature is enabled, so queries can reference datasets like ggsql:world.
• Explicit chart kwargs: VegaLiteWriter.render_chart() and render_altair() now accept validate, height, and width as keyword arguments (height/width default to None, preserving ggsql's dimensions; validate defaults to False, same behavior as before).
• Dependency bumps: Arrow v56 → v58; Python package version bumped to 0.5.2 to match the crate.

Also documents the py/v* release-tag workflow in CLAUDE.md.

Note: Windows jobs pinned to windows-2022 (temporary)

windows-latest now resolves to a Windows Server 2025 image with the VS2026/v145 toolchain, whose STL removed stdext::checked_array_iterator. ggsql 0.5.2 pins duckdb ~1.10502, and duckdb 1.5.2's vendored fmt still uses that symbol under #ifdef _SECURE_SCL, so the bundled duckdb build hard-fails on windows-latest (duckdb/duckdb-rs#783, fixed in libduckdb-sys 1.10506.0). Upstream ggsql doesn't hit this today because its PR CI is ubuntu-only and its release builds already pin windows-2022, whose VS2022/v143 STL still carries the deprecated symbol.

This PR therefore pins both Windows workflows (python.yml, release-python.yml) to windows-2022 as a stopgap, with in-file comments explaining why. Follow-up: once a ggsql release depends on duckdb ~1.10506, bump the ggsql dependency and revert both pins to windows-latest.

Verification

import ggsql

reader = ggsql.DuckDBReader("duckdb://memory")
spec = reader.execute("SELECT 1 AS x, 2 AS y VISUALISE x, y DRAW point")

svg = ggsql.SVGWriter(width=600, height=400).render(spec)  # str
pdf = ggsql.PDFWriter(width=600, height=400).render(spec)  # bytes

ggsql.save(spec, "plot.svg")
ggsql.save(spec, "plot.pdf")
ggsql.save(spec, "plot.json")  # Vega-Lite JSON

Tests: uv run pytest tests/ -v (includes new coverage for the native writers, save(), and builtin datasets). Rust checks: cargo fmt -- --check, cargo clippy -- -D warnings.

Closes #8

[cpsievert]

Copilot review findings addressed in c6a8ce6:

1. MSRV — bumped rust-version to 1.88, which the native-writer dependency graph (parley 0.9.0) requires.
2. DPI validation — SVGWriter/PDFWriter constructors (and thus ggsql.save()) now raise ValueError for non-positive or non-finite dpi.
3. Builtin-data coverage — added integration tests executing ggsql:penguins and ggsql:airquality (including an end-to-end SVG render), plus dpi validation tests. Test count: 64 → 77.