fix: reject null list slots and empty geohashes

[mailletf]

Two pre-existing input-validation gaps surfaced by an adversarial review of the stack (they pre-date PRs #31–#40, so they get their own PR on top):

• Null geohash_lists slots in expand_geohash_mapping_arrow were silently read through their offsets and became empty groups. pyarrow happens to write equal offsets under a null slot, but the Arrow spec allows them to span arbitrary positions of the values buffer, so foreign-written data could expand undefined bytes as geohashes. Null geog_ids and null list elements already errored; null list slots now do too.
• The empty geohash "" decodes to the whole-world bbox in the geohash crate, so an empty value from an upstream join quietly became a planet-sized polygon (or expansion sample). Every decode of user input now goes through a checked wrapper that refuses it — list, Arrow, and expansion entry points.

Both come with Rust and Python tests.

🤖 Generated with Claude Code

[mailletf]

This change is part of the following stack:

• fix: don't drop multipolygon parts whose seed lands in an earlier part #30
  • perf: cover polygons by descending the geohash tree #31
    • perf: optionally dictionary-encode geog_id in the Arrow mapping output #39
      • perf: cover large polygons across Rayon workers #40
        • fix: reject null list slots and empty geohashes #42 ◀

_{Change managed by git-spice.}