TiDB returns internal planner error for FIRST_VALUE over a derived aggregate query with HAVING COUNT(*)

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

```
DROP DATABASE IF EXISTS tidb_planner_having_window;
CREATE DATABASE tidb_planner_having_window;
USE tidb_planner_having_window;

CREATE TABLE t(a INT);
INSERT INTO t VALUES (1);

SELECT FIRST_VALUE(sq.c) OVER (ORDER BY sq.c) AS w
FROM (
SELECT COUNT(*) AS c
FROM t
GROUP BY a
HAVING COUNT(*) = 1
) AS sq;
```

### 2. What did you expect to see? (Required)

```
w
1
```

### 3. What did you see instead (Required)

`ERROR 1105 (HY000): Can't find column Column#4 in schema Column: [Column#3] Unique key: []`

### 4. What is your TiDB version? (Required)

```
Release Version: v8.5.7
Edition: Community
Git Commit Hash: 202b7f47286a1109b5c957401d34c9358d130ae0
Git Branch: HEAD
UTC Build Time: 2026-07-15 02:06:00
GoVersion: go1.25.10
Race Enabled: false
Check Table Before Drop: false
Store: unistore
```

Start by running the provided SQL reproduction against TiDB and tracing planner handling of FIRST_VALUE over the derived aggregate query with HAVING COUNT(*). The work is done when the query returns w = 1 instead of the internal planner error, with regression coverage for this case.

Written by the indexing model from the issue text.