Null-safe equality (<=>) on a RANGE-partitioned table panics and kills the connection

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

CREATE TABLE tr(a int) PARTITION BY RANGE(a)
(PARTITION p0 VALUES LESS THAN (10), PARTITION p1 VALUES LESS THAN (MAXVALUE));
INSERT INTO tr VALUES (1), (11), (NULL);
SELECT a FROM tr WHERE 1 <=> a;

### 2. What did you expect to see? (Required)

```
mysql> INSERT INTO tr VALUES (1), (11), (NULL);
Query OK, 3 rows affected (0.00 sec)
Records: 3 Duplicates: 0 Warnings: 0

mysql> SELECT a FROM tr WHERE 1 <=> a;
+------+
| a |
+------+
| 1 |
+------+
1 row in set (0.00 sec)

mysql> select version();
+-----------+
| version() |
+-----------+
| 9.7.2 |
+-----------+
1 row in set (0.00 sec)
```
### 3. What did you see instead (Required)
```
mysql> CREATE TABLE tr(a int) PARTITION BY RANGE(a)
-> (PARTITION p0 VALUES LESS THAN (10), PARTITION p1 VALUES LESS THAN (MAXVALUE));
Query OK, 0 rows affected (0.01 sec)

mysql> INSERT INTO tr VALUES (1), (11), (NULL);
Query OK, 3 rows affected (0.00 sec)
Records: 3 Duplicates: 0 Warnings: 0

mysql> SELECT a FROM tr WHERE 1 <=> a;
ERROR 1105 (HY000): invalid input parameternulleq
```
### 4. What is your TiDB version? (Required)

```
mysql> select tidb_version();
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version() |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v8.5.8-dirty
Edition: Community
Git Commit Hash: 8b857efa20363d50a8fa2ea7dd9809a85a61b115
Git Branch: HEAD
UTC Build Time: 2026-08-31 12:40:55
GoVersion: go1.25.12
Race Enabled: false
Check Table Before Drop: false
Store: unistore |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

```

Start by running the reported CREATE TABLE, INSERT, and SELECT statements against TiDB, focusing on RANGE partitioning and the null-safe equality operator. Trace the failure reported as "invalid input parameternulleq" and compare it with the expected single-row result for a non-NULL value. Done means the query returns 1 without an error or connection failure, while preserving the shown partition behavior.

Written by the indexing model from the issue text.