fix(data_operations): align PROPERTY_MAPPING declarations with runtime dispatch

[TKaltofen]

Closes #326.

What

Makes the PROPERTY_MAPPING declaration the authority for frame aggregation, rank and offset, so a supported operation is accepted the same way whether it arrives in a feature name or in Options.

Frame aggregate composed the base matcher instead of replacing it. Its four name shapes (rolling, time window, cumulative, expanding) became the class prefix patterns, the name path validates through _validate_string_match, and the override keeps only what a shared class-level declaration cannot express: the per-subclass SUPPORTED_FRAME_TYPES / SUPPORTED_TIME_UNITS narrowing and the partition_by / order_by shape checks. aggregation_type and frame_type dropped default: None so the config path really requires them, frame_size gained a positive-integer guard plus required_when, and frame_unit gained its declared value space plus required_when. A frame name carries its own size and unit, so those conditional requirements are exempted on the name path.

Rank and offset declare their parametric families through one predicate shared by both paths, so ntile_N, top_N, bottom_N, lag_N, lead_N, diff_N and pct_change_N now match identically from a name or from Options. offset_type became strict, which ends the acceptance of arbitrary strings such as "banana".

Zero and negative suffixes, malformed parametric tokens and unsupported operations are now rejected while matching rather than at compute.

Review findings folded in

Two independent deep reviews ran on the first commit; the second commit is their triage:

• zero-sized frames (sales__sum_rolling_0, sales__avg_0_day_window) matched on the name path and either crashed or silently computed a degenerate window; the size group is now [1-9]\d*, as binning already does
• a single-element container is legal syntax for one operation token, but the dispatch-side readers stringified it into "('sum',)"; op_token_value unwraps it for all three families and for the capability-hook resolvers
• str.isdigit() accepts superscripts that int() then rejects, so value__ntile_²_ranked raised out of the matcher and aborted resolution; it also accepts non-ASCII digits that reached compute. A parametric suffix is now an ASCII decimal
• hostile in_features values ("", 0, 3.5, True, a dict) raised from core's unguarded count check instead of failing to match; all three families guard that entry

Tests

MatchValidationTestBase gained opt-in parity_operations() / malformed_operations() hooks that assert both creation paths agree, wired for the three families in scope. Frame adds a local parity test over all four of its name shapes, since the shared harness builds only the rolling one. Full tox gate green: 4442 passed, 168 skipped, plus ruff format, ruff check, strict mypy and bandit.