feat: pin core v2.6.2

[vbanas]

Move the vendored core pin from v2.6.1 (a99a019) to v2.6.2 (2c10dba), with CORE_VERSION / CORE_COMMIT in rayforce-sys/build.rs moved alongside. rayforce-q stays at 1eabaf4, which is still its tip; no tag newer than 2.1.1 exists.

Nothing in the binding layer moves. include/rayforce.h and the Makefile are byte-identical between the two tags. Of the private headers bindgen reads, only src/lang/internal.h changes, adding ray_ipc_txlimit_fn, which is not in INTERNAL_FNS. No source file is added or removed outside test/, so stage_core, the Cargo.toml include globs and the link libraries are untouched. core/poll.h carries a bare _Atomic that the -D_Atomic(T)=T workaround does not rewrite, but it is not in bindgen's translation unit, and that field predates this tag anyway.

The core changes five answers a caller can see. A slice now inherits its parent's HAS_NULLS hint: before, every gate that reads the bit took a window over a null-bearing vector for null-free, so an aggregate over a Value::slice folded the sentinel in as a value; is_null_at already asked the parent. The splayed save path derives the persisted bit from the payload rather than trusting the in-memory header, so a column holding a sentinel reloads with its nulls. nil? is element-wise over a vector or a list outside queries, answering a B8 vector where it used to answer false. The parser rejects a symbol, keyword, name or number glued to a quote, a colon or another name character, so ['a:1] and 0Na are parse errors rather than two tokens each. And load_parted no longer takes a calendar-impossible directory such as 2024.02.31 for a date partition, which it used to normalise silently into 2024.03.02; a root holding one falls back to symbol partitions.

The rest does not reach this crate's surface: .log.write is refused inside an auto-journaled IPC eval, the per-connection transmit backlog becomes configurable through .ipc.txlimit with the old 256 MiB cap as its default, multicast frames a publication once for all subscribers, .mc.sub no longer requires a filter, and a script or a piped session stays alive until its pending timers are spent.

The docs follow: README and installation.md name the new tag, the changelog records the deltas, and vector.md's null section says a slice inherits its parent's hint.

The suite passes against the vendored pin, on the release flavour and on the debug flavour with RAY_DFD=1 armed, each with a v2.6.2 server built from its own staged core the way CI builds one. clippy is clean at -D warnings.