fix(context): Report bounded graph evidence honestly

[reneleonhardt]

What does this PR do?

• Builds one bounded request-local dependency graph for CLI and HTTP context.
• Reports unavailable evidence and unknown risk instead of false zero hubs or low risk.
• Keeps prompt hooks scan-free and propagates HTTP cancellation.

This prevents agentic coding workflows from treating missing graph evidence as a safe change.

Type of change

• Bug fix
• New feature
• New language support
• Documentation
• Other

Checklist

• Tested locally with GOENV_VERSION=1.26.5 go test ./cmd ./scanner ./watch -count=1
• Verified with full vet and race tests
• Updated context and hook documentation

Additional notes

The JSON envelope is version 2: hub counts are nullable and graph availability is explicit.

Developed with carefully directed, manually reviewed AI assistance.

[JordanCoin]

The evidence direction is good, but the availability check conflates a complete edge-free graph with an incomplete scan: . I reproduced this with a valid one-file Go module: a fresh complete scan returns , , and instead of a proven zero. Please distinguish completeness using scanner provenance/coverage: complete authoritative scans with zero edges are available with zero hubs, while failed/unavailable provenance remains unavailable. Add both regression cases and I will re-review and merge.

[JordanCoin]

Correction with the exact expressions omitted by shell formatting in my review: the problematic condition is graph == nil || (len(graph.Imports) == 0 && len(graph.Importers) == 0). The valid edge-free reproduction returns graph_evidence.reason = scan_incomplete, hub_count = null, and risk = unknown.

[JordanCoin]

Re-reviewed at d108f2d. Complete edge-free graphs now report fresh available evidence with zero hubs, while explicit unavailable and failed-only provenance stays fail-closed even when edge maps contain data. Focused and full local suites pass, as do all 12 CI jobs. Approved.