[Improve] Restore selective property pushdown with complete label index coverage

### Background

Follow-up to [PR #2994 review](https://github.com/apache/hugegraph/pull/2994#discussion_r3972183225), inspected at `2d53a556c001a13f5efafffc70cc60bee8b15496`.

`TraversalUtil.hasUnsafeLabelInTraversal()` conservatively prevents property-index pushdown when a later unsafe label predicate could require candidates from labels without equivalent property-index coverage. It examines child/ancestor contexts and remains conservative across unproven element changes and extension steps. Local filtering preserves complete results, but can turn a selective property lookup into a large candidate scan.

The existing FIXME identifies the intended optimization: restore selective property pushdown only when every candidate schema label is proven to have compatible index coverage. Safe positive label-index lookup, already restored in PR #2994, is separate from this property-index problem.

### Scope and acceptance

- [ ] Define a sound way to identify the candidate labels for the element actually being filtered, respecting child/ancestor traversal context and element-identity changes.
- [ ] Require complete, predicate-compatible index coverage for every candidate label before extracting a property predicate. Keep local filtering when the proof is unavailable or incomplete.
- [ ] Cover missing/disabled indexes, composite indexes, range/SEARCH semantics, and schema/index changes between optimization and execution; document the supported lifecycle boundary.
- [ ] Verify result-set equivalence with conservative local filtering for negative labels, mixed connectives, barriers, nested/repeat/select contexts, explicit IDs, and adjacency queries.
- [ ] Preserve range/offset ordering, count, side effects, and paging through empty filtered pages. Do not bypass filters or silently weaken resource limits.
- [ ] Add plan assertions showing extraction only in proven-safe cases and retention of the local fallback in counterexamples.
- [ ] Measure candidate counts and latency on identical data/configurations for both fully covered and partially covered label sets, including RocksDB and HStore. Report measured gains rather than assuming them.

Keep PR #2994's correctness-first fallback until this proof and its regression tests are ready. This issue does not include the per-element CONTAINS conversion cache tracked in #3196 or coverage-report collection changes.

Start with TraversalUtil.hasUnsafeLabelInTraversal() and the correctness-first fallback restored in PR #2994. Trace the child/ancestor and element-identity cases, then add plan and result-equivalence regression tests for the listed counterexamples. Done means safe extraction only with complete compatible coverage, preserved fallback behavior, and measured candidate-count and latency comparisons on RocksDB and HStore.

Written by the indexing model from the issue text.