Decouple fatal logging from process termination #887

LogLevel::kFatal and the fatal logging macros unconditionally call std::abort(). FatalHandler runs before the abort, but it is process-global and cannot prevent termination.

This is unsafe for embedded and multi-tenant applications, where one failed Iceberg operation must not terminate the host process.

Logging should not control process lifetime. Recoverable failures should continue to use Status/Result, while termination for unrecoverable internal invariants should use a separate, explicit mechanism.