Decouple fatal logging from process termination

`LogLevel::kFatal` and the fatal logging macros unconditionally call `std::abort()`. `FatalHandler` runs before the abort, but it is process-global and cannot prevent termination.

This is unsafe for embedded and multi-tenant applications, where one failed Iceberg operation must not terminate the host process.

Logging should not control process lifetime. Recoverable failures should continue to use `Status`/`Result`, while termination for unrecoverable internal invariants should use a separate, explicit mechanism.

Start by locating the definitions and call sites for LogLevel::kFatal, the fatal logging macros, and FatalHandler. Read how recoverable failures use Status/Result and trace where std::abort() is invoked. Done should be demonstrable by logging a fatal condition without forcing process termination, while unrecoverable invariant termination remains explicit.

Written by the indexing model from the issue text.