[This document](https://docs.google.com/document/d/1lI19F2hHmcZRnwWPVKrnvkFgxaTs6CHnJ81kbXygfVw/edit?tab=t.0) provides a summary of the analysis of all uses of the Estimates library, classifying all risks, and their mitigation.

The cost-based ranker's Estimates library layers approximate comparison
(epsilon-based `operator==` / `operator<=>`) on top of bit-exact arithmetic and
bit-exact `assertValid()` bounds. That mismatch let a fuzzy guard pass while the
arithmetic it guarded stepped outside `[kMin, kMax]` and tripped a tassert, and
it forced callers to hand-write per-site workarounds.

This PR makes the library resilient to the mismatch so fewer tasserts fire and
callers no longer need to understand the epsilon details.

Changes in `optimizer/cost_based_ranker/estimates.

`:

• `OptimizerEstimate::operator+=` / `operator-=` are now tolerance-aware
  saturating: a result that steps outside `[kMin, kMax]` by less than epsilon
  (the same tolerance `operator==` uses) saturates to the bound; a larger,
  genuine violation still trips the tripwire assertion, preserving real-error
  detection.
• New exact-comparison helpers `min()` / `max()` (compare the underlying values
  exactly, so they never return the larger/smaller operand on a fuzzy tie),
  `positiveDifference()` (saturating `max(0, a - b)`), and a robust
  `operator/(CardinalityEstimate, CardinalityEstimate)` that short-circuits to
  selectivity `1.0` on approximate equality before its exact precondition and
  clamps the result to `[0, 1]`.

These replace the previous per-site band-aids (strict-comparison ternaries and
`std::min` / `std::max`, which derive from the fuzzy `operator<=>` and can
return the wrong operand on an epsilon tie) at the `$limit` (`limitNodeCard`,
`STAGE_LIMIT`), `$skip`, `OrderedIntervalList` cap, NDV floor, index-seek and
sort-limit sites in `cardinality_estimator.cpp` and `cost_estimator.cpp`.

Tests: unit coverage in `estimates_test.cpp` (saturation, exact `min`/`max`,
`positiveDifference`, robust `operator/`, plus DEATH_TESTs asserting that
genuine violations still trip the tripwire) and a `$limit` regression case in
`cbr_approximate_comparator_misuse_bug.js`. Behavior is preserved: the
plan_stability golden tests show no plan changes.