Fuse filterless AVG release

[ila]

Thanks for reviewing.

Summary

• remove the unused filterless query/group nonce from compiler expressions, aggregate state, bind arities, tests, and docs
• fuse the upper SUM and exact COUNT releases for AVG into one internal priv_filterless_avg aggregate
• retain the existing lower paired per-PU partials and preserve BIGINT/DECIMAL exactness
• keep the existing privacy accounting: one visible-cell budget per AVG, split 50/50 internally between independently noised SUM and COUNT components

This is stacked on #24 because it consumes the paired lower partials introduced there.

Why

The nonce was carried through every row and aggregate state but never influenced the secure DP randomness. Removing it reduces state and expression plumbing without changing release behavior.

AVG previously scanned the upper per-PU stream twice (once for SUM and once for COUNT) and then added a ratio projection. The fused aggregate performs the same component updates/releases in one upper pass and returns the ratio directly, including NULL for a nonpositive released count.

Validation

• ninja -C build/release -j4
• build/release/test/unittest "test/sql/dp_filterless.test" — 161 assertions
• build/release/test/unittest — 7,450 assertions
• build/release/extension/privacy/pac_test_runner
• real SF30 query with DECIMAL and integer AVG, plus physical-plan inspection
• git diff --check

The focused tests verify the fused plan shape, mixed SUM/COUNT/AVG results, all-NULL AVG semantics, and exact HUGEINT/DECIMAL lower partials.

Performance

Isolated 30M-row upper-stage runs:

• DOUBLE AVG: 1.01s → 0.87–0.88s (~13%)
• HUGEINT AVG: 1.21s → 1.09s (~10%)

The full SF30 query remains lower-stage dominated; warm end-to-end runs were effectively tied (3.69s vs 3.66s) with identical results.