v2: callee-anchoring defect propagates through L2 callee backfill into the canonical tree and call_graph (CLDK-001 + CLDK-002)

[rahlk]

Target: canonical schema v2 (epic #69, stage #72). v2 counterpart of #80, which tracks the same defect on v1/main and holds the full audit evidence and the minimal reproduction — one root cause, two lineages, so the fix must land (or be forward-ported) on the feat/v2-stage* chain independently of when/whether a 1.x maintenance release picks it up.

Why v2 is affected

The v2 stage chain shares symbol_table_builder.py with v1, and its L2 stage consumes the defective value directly:

• The wrong anchor is present on the v2 chain at symbol_table_builder.py:610-613 (_infer_callee / return_type inferred at node.lineno, node.col_offset — the first character of the call expression, i.e. the receiver token for any attribute call).
• L2's backfill_callees (codeanalyzer/schema/l2_callees.py) copies cs.callee_signature verbatim into each body call node's callee — "the one sanctioned value change" of L2. Every receiver-type binding therefore becomes a wrong callee id in the canonical tree and a wrong call_graph edge at application scope.

Measured impact on v1 exports (same producer code): 52,483/59,523 resolved callsites bind to a differently-named symbol; 99.93% of Odoo env[...] calls bind to the caller's own enclosing class. See #80 for the breakdown, Cypher, and fixture.

Acceptance for v2

• Fix at the source (_infer_callee anchoring) so L2 inherits correct values; no compensating logic in l2_callees.py.
• Add the Callee inference anchors at call-expression start: attribute calls resolve to receiver type, 99.9% of Odoo env calls bind to enclosing class (CLDK-001 + CLDK-002) #80 fixture as a regression test on the v2 chain.
• Extend the L2 stage gate: alongside "no dangling call-graph endpoints", enforce the audit gate — ≥95% target-name equality for resolvable non-constructor calls, and no class fallback when the exact method exists.

[rahlk]

Acceptance met — closing.

• Fix at the source: the _infer_callee anchoring fix (attribute calls anchored inside the attribute name, Callee inference anchors at call-expression start: attribute calls resolve to receiver type, 99.9% of Odoo env calls bind to enclosing class (CLDK-001 + CLDK-002) #80/fix: anchor callee inference at the attribute name, not the call-expression start #89) reached the v2 chain via the v0.3.1→v2 reconciliation merge and shipped in v1.0.0; l2_callees.py copies the now-correct value with no compensating logic.
• Regression fixture: the Callee inference anchors at call-expression start: attribute calls resolve to receiver type, 99.9% of Odoo env calls bind to enclosing class (CLDK-001 + CLDK-002) #80 method_call_resolution fixture and its tests (test_attribute_calls_resolve_to_the_invoked_method, test_attribute_calls_never_bind_to_the_enclosing_class, ...) run on the v2 chain and pass.
• L2 stage gate: test_v2_l2.py::test_l2_audit_gate_callee_name_equality (PR fix(determinism): byte-identical analysis output for identical runs #101) enforces ≥95% target-name equality for resolvable non-constructor calls and rejects any class fallback where the exact method exists — alongside the existing no-dangling-endpoints gate from Schema v2 conformance gaps vs keystone — stage-5 gate before v0.4.0 (edge keys, mixed identity, containment names) #98.