TiFlash `substring` behavior differs from TiDB

## Bug Report

The `substring` function returns different results in TiFlash compared to TiDB.

### 1. Minimal reproduce step (Required)
```sql
create table t2 (c1 bigint unsigned);
insert into t2 (c1) values(18446744073709551615);

-- use tidb
select substring(0, c1, 10) from t2; -- result: '0'

-- use tiflash
alter table t2 set tiflash replica 1;
set SESSION tidb_enforce_mpp = ON;
select substring(0, c1, 10) from t2; -- result: ''
```

### 2. What did you expect to see? (Required)
```
+----------------------+
| substring(0, c1, 10) |
+----------------------+
| 0 |
+----------------------+
1 row in set (0.00 sec)
```

### 3. What did you see instead (Required)
```
+----------------------+
| substring(0, c1, 10) |
+----------------------+
| |
+----------------------+
1 row in set (0.09 sec)
```

### 4. What is your TiDB version? (Required)

```
Release Version: v8.5.3
Edition: Community
Git Commit Hash: dc2548aac79a712265e831cff2a3a896bc0a5a38
Git Branch: HEAD
UTC Build Time: 2025-07-31 13:54:43
GoVersion: go1.23.8
Race Enabled: false
Check Table Before Drop: false
Store: tikv
```

Run the supplied SQL reproduction with TiDB and TiFlash to confirm the differing substring results. Locate the substring implementations and related tests for both execution paths, then add regression coverage showing the expected result and verify that TiFlash matches TiDB.

Written by the indexing model from the issue text.