fluentbit: upgrade to v4.2.8 and pin dependencies

[solsson]

fluentbit: v4.2.8, pinned Arrow, and the format requirements written down

• FLB_VERSION 4.2.2 → 4.2.8.
• Arrow glib pinned to 25.0.1-1. The apt source package is published only as
  "latest", so this was the one unpinned input in an otherwise digest-pinned
  build.
• New images/fluentbit/REQUIREMENTS.md: the invariants compact_columns.c
  exists to hold, which were nowhere stated as requirements. An object written
  wrong is unreadable for its whole 365-day retention.
• test.sh now asserts the arrow schema (R1 time is timestamp[ns], R3
  stream/logtag are int8-dictionary) using the pyarrow validator it already
  ran but never checked — output was captured with || true and echoed. With
  dictionary encoding in place the DuckDB assertions can only ever SKIP, so the
  arrow format was effectively unguarded.
• Fixes two comments that stated the opposite of the truth: compact_columns.c
  claimed nanoarrow reads dictionary columns back as VARCHAR (it fails at
  schema decode), and compact_columns.h claimed no body compression while the
  code sets ZSTD.
• README described a build//example/ layout that no longer exists and
  parquet-only output that production dropped.

Not in scope

Dictionary encoding stays (decided 2026-08-10). Removing it costs +1.77%
aggregate over a 102-object sample of a production day and is a two-sided
trade; the time-column normalization is what carries compact_columns (+6.6%).
The consequence — DuckDB cannot read our .arrow objects — is documented in
REQUIREMENTS.md along with why the upstream fix is further off than
duckdb-nanoarrow#25 suggests. arrow-go and pyarrow read them natively, so
nothing operational is blocked.

Base image digests are not refreshed here, deliberately: a mechanical change
better kept out of the run that validates the version bump.

Verification

• All three patches apply to a real v4.2.8 checkout;
  apply-compact-compression.sh under GNU sed still lands
  ARROW_COMPACT/PARQUET_COMPACT at 5/6 with no collision, all 8 expected
  files modified.
• Pinned Arrow install resolves: pkg-config --modversion arrow-glib → 25.0.1.
  Both amd64 and arm64 carry the version.
• bash -n test.sh clean.
• The k3d e2e was not run locally (needs a full fluent-bit compile) — that
  is what this PR's CI is for.

Risk

Assertion 7a2 hard-fails when the arrow-inspect pod produces nothing, where
that was previously tolerated. Intended, but it will redden CI if that pod is
flaky for infra reasons rather than passing quietly.

🤖 Generated with Claude Code