Inconsistent behaviour between normal and prepared SELECT when use subquery in ON condition

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

In the following test case, there are two equivalent queries: one is a normal SELECT, the other is a prepared SELECT. However, the normal SELECT executes successfully, but the prepared SELECT triggers an error.

```
CREATE TABLE t0(c0 CHAR, c1 BOOL, c2 BOOL);
REPLACE INTO t0 VALUES (NULL, false, false);
SELECT t0.c0 FROM t0 LEFT JOIN t0 AS t0_0 ON (('')!=((SELECT t0.c1 FROM t0 WHERE t0.c1 GROUP BY t0.c1 HAVING ((t0.c2)AND(NULL))))); -- NULL
SET @d = '';
SET @f = NULL;
PREPARE prepare_query FROM 'SELECT t0.c0 FROM t0 LEFT JOIN t0 AS t0_0 ON ((?)!=((SELECT t0.c1 FROM t0 WHERE t0.c1 GROUP BY t0.c1 HAVING ((t0.c2)AND(?)))))';
EXECUTE prepare_query USING @d,@f; -- ON condition doesn't support subqueries yet
```

### 2. What did you expect to see? (Required)

These two queries should have the same behaviour.

### 3. What did you see instead (Required)

These two queries have different behaviours.

### 4. What is your TiDB version? (Required)

Release Version: v9.0.0-beta.2.pre-1118-gfc6f7b2e42\nEdition: Community\nGit Commit Hash: fc6f7b2e42be08957a9b80e5761bfa4793066353\nGit Branch: master\nUTC Build Time: 2026-01-26 12:27:51\nGoVersion: go1.25.6\nRace Enabled: false\nCheck Table Before Drop: false\nStore: unistore\nKernel Type: Classic