Decouple fatal logging from process termination

`LogLevel::kFatal` and the fatal logging macros unconditionally call `std::abort()`. `FatalHandler` runs before the abort, but it is process-global and cannot prevent termination.

This is unsafe for embedded and multi-tenant applications, where one failed Iceberg operation must not terminate the host process.

Logging should not control process lifetime. Recoverable failures should continue to use `Status`/`Result`, while termination for unrecoverable internal invariants should use a separate, explicit mechanism.

首先定位 LogLevel::kFatal、fatal 日志宏和 FatalHandler 的定义及调用位置。阅读可恢复故障如何使用 Status/Result，并追踪 std::abort() 的调用位置。完成情况应能够通过记录 fatal 条件而不强制进程终止来证明，同时不可恢复不变量导致的终止仍应保持显式。

由索引模型根据 Issue 内容生成。