Incorporate codeanalyzer-python v1.3.0

[rahlk]

A new codeanalyzer-python release (v1.3.0) is published.
Update the codeanalyzer-python pin in this repo and adapt the
integration to the changes below (see PyCodeanalyzer._run_analyzer).

[1.3.0] - 2026-08-29

Added

• Schema v2 now captures non-code artifacts (application.artifacts), declared
  dependencies with provenance (application.dependencies), and undeclared
  imports (application.unresolved_imports) at every analysis level (feat: add per-variable field initializers from codeanalyzer 2.3.8 #157).
  Neo4j gains language-neutral :Artifact/:Package nodes (purl ids) joined
  to the existing :PyExternal ghosts. New flag: --resolve-installed.
  Lockfile-only (transitive) pins are emitted as direct: false dependency
  records attributed to the lock artifact (Python analysis parity with Java (codeanalyzer-python backend) #152 reconciliation).
• Artifact discovery never drops a file: every non-.py file is now
  inventoried, matched or not (unmatched decodable files as text/unknown,
  anything not UTF-8 decodable as binary with empty source). New
  PyArtifact.text_truncated field plus --artifact-text/--no-artifact-text
  and --artifact-text-max-bytes flags control verbatim source capture;
  sha256/size_bytes always reflect the full file regardless (feat: add per-variable field initializers from codeanalyzer 2.3.8 #157).
• The release workflow now also stages schema.cypher (the same Neo4j
  schema contract as runnable, ;-terminated Cypher DDL -- uniqueness
  constraints plus indexes) as a GitHub Release asset alongside schema.json.
• Configuration keys extracted as first-class ConfigKey nodes from six v1
  formats (.env, yaml, json, toml, ini, properties), with
  reference recognition and DEFINES_CONFIG Neo4j projection; namespace
  discriminators per format (Python analysis parity with Java (codeanalyzer-python backend) #152).
• PY_USES_CONFIG edges from call sites to the ConfigKey they read,
  resolved in three deterministic tiers: literal keys at -a 2, single-literal
  def-use chains at -a 3, interprocedural parameter-passing chains at -a 4.
  Unresolved reads (non-literal keys, undefined keys) emitted in
  application.config_reads_unresolved with reasons; PY_READS_CONFIG_UNRESOLVED
  Neo4j projection (Source all codeanalyzer-* from PyPI; kill bundled bin/jar dirs #162).
• Deployment-env config-key namespaces: Dockerfile ENV/ARG directives
  (multi-key, legacy space form, backslash continuations, quoted values) and
  compose/k8s environment/env shapes are now extracted too. ENV and
  compose/k8s environment/env entries mint namespace env, so
  os.environ/os.getenv reads resolve against deployment-declared
  variables; Dockerfile ARG mints its own dockerfile namespace
  (build-time only, not env-detector-bindable). Compose/k8s recognition
  dual-mints alongside the plain yaml dotted-path keys, by design (Read-only Python Neo4j backend, per-language factory facade & typed backend configs (#160–#164) #165).
• The release workflow also ships the analyzing-canpy-graphs skill as
  versioned assets: analyzing-canpy-graphs-skill.tar.gz (SKILL.md plus the
  vocabulary and analyses references, Cypher-only) and the standalone
  SKILL.md, staged next to schema.json/schema.cypher.
• Call arguments carry literal evidence: PyCallArgument.value (JSON-encoded
  constants) and PyCallArgument.name (bare identifiers) at every level.

Fixed

• The SDG builder resolves callsites from L2-backfilled body callees (the
  deterministic linker-backed path) instead of Jedi's cache-sensitive
  callee_signature side channel, and the shared dataflow test fixtures
  build at level 2 -- removing a full-suite-only order dependence.