docs(physical-optimizer): warn that wrapper rules must forward schema_check (#25357)

## Which issue does this PR close?

Closes #25316.

## Rationale for this change

`OptimizationInvariantChecker` consults `schema_check()` on the rule the
optimizer holds. For a rule that runs *other* rules inside its own
`optimize()` — an instrumentation wrapper, a conditional wrapper, a rule
that fuses a short sequence — the optimizer never sees the inner rules,
only the wrapper.

Returning `false` from such a wrapper therefore disables schema
validation for everything it wraps, including rules that explicitly
opted in. Nothing warns at registration or at run time; validation
simply stops happening, and the loss only surfaces if a schema-changing
regression happens to hit that path. I walked into this myself: `false`
looked correct because each wrapped rule had its own `schema_check()`,
but those values are never consulted once the rules are inside a
wrapper.

## What changes are included in this PR?

A doc comment on `schema_check()` stating the requirement, with the
one-line `any()` form, so an implementor reads it where they make the
decision.

## Are these changes tested?

Documentation only, no behavior change.

## Are there any user-facing changes?

Doc only.

Author: zhuqi-lucas

datafusion/session/src/physical_optimizer.rs

@@ -80,5 +80,34 @@ pub trait PhysicalOptimizerRule: Debug + std::any::Any {
     /// change the schema of the plan after the rewriting.
     /// Some of the optimization rules might change the nullable properties of the schema
     /// and should disable the schema check.
+    ///
+    /// The planner reads this from the rule it holds, so a rule that runs
+    /// *other* rules inside its own [`optimize`] must account for what the
+    /// whole wrapped transformation does to the schema, not just its own body:
+    ///
+    /// * A wrapper around a single rule should forward that rule's value.
+    /// * A wrapper that runs multiple rules should return `true` only if the
+    ///   complete wrapped transformation preserves the schema contract. When
+    ///   that is derived solely from the wrapped rules, every wrapped rule must
+    ///   enable the check (`all()`, not `any()`): if any wrapped rule is allowed
+    ///   to change the schema, returning `true` makes the checker assert a
+    ///   change it should tolerate.
+    /// * A wrapper mixing schema-preserving and schema-changing rules cannot be
+    ///   expressed as a single flag; validate per-rule inside the wrapper so the
+    ///   inner checks are retained.
+    ///
+    /// When the flag can be derived from the wrapped rules, `all()` (not
+    /// `any()`) is the safe combinator:
+    ///
+    /// ```text
+    /// fn schema_check(&self) -> bool {
+    ///     self.wrapped.iter().all(|rule| rule.schema_check())
+    /// }
+    /// ```
+    ///
+    /// Returning a blanket `false` still silently disables validation for
+    /// everything inside, including rules that asked for it.
+    ///
+    /// [`optimize`]: PhysicalOptimizerRule::optimize
     fn schema_check(&self) -> bool;
 }