fn safe_predicate(expr: &Expr, schema: &DFSchema) -> Result<bool>
Rejects explicitly volatile, fallible or subquery expressions. Column references additionally require input-plan provenance checks.