walker: schema-existence ERROR diagnostics (ADR-0027 step B)

`MatchedKind::Ident` now carries its `IdentSource`. A
post-walk pass over a structurally-valid parse flags a
matched `Tables` ident that is absent from the schema, or a
`Columns` ident absent from the table in scope, as an ERROR
diagnostic — the command parses but would fail at execution
(ADR-0027 §2). New behaviour: an unknown table / column used
to parse cleanly and fail only when run.

Column scope is resolved by one left-to-right pass over the
matched path (every command places its table ident before
the columns that belong to it); an unknown table clears the
scope, so its columns are not cascaded into a second
diagnostic. New catalog keys `diagnostic.unknown_table` /
`diagnostic.unknown_column`.

src/dsl/walker/outcome.rs

@@ -109,8 +109,14 @@ pub enum MatchedKind {
     /// on it canonically.
     Word(&'static str),
     Punct(char),
-    /// An `Ident` matched. The role identifies which slot.
-    Ident { role: &'static str },
+    /// An `Ident` matched. `role` identifies which slot;
+    /// `source` is the slot's `IdentSource` — the post-walk
+    /// schema-existence check (ADR-0027 §2) reads it to decide
+    /// whether a matched name must exist in the schema.
+    Ident {
+        role: &'static str,
+        source: IdentSource,
+    },
     NumberLit,
     StringLit,
     BlobLit,