Analysis venv (uv + Jedi wiring), external_symbols, app-scoped prune, --no-venv (#44 #45 #46 #47)

[rahlk]

Summary

Fixes four issues on the Neo4j / analysis pipeline.

Changes

#47 -- install the analysis venv with uv and wire it to Jedi

The per-project analysis venv was built and populated but never used: __init__
left self.virtualenv = None and never reassigned it, so SymbolTableBuilder got
None and Jedi resolved against the default environment, ignoring the installed
dependencies. Now self.virtualenv is set on both a fresh build and a lazy reuse.
Dependency installation uses uv (uv pip install --python <venv>) instead of pip
for speed (parallel + shared cache); uv ships in its wheel so it is present
wherever canpy is installed, including Docker, with a pip fallback.

#44 -- first-class external_symbols (codeanalyzer-typescript parity)

External call targets are now first-class in the IR instead of being re-derived
ad hoc in the projection. Adds PyExternalSymbol{name, module} and
PyApplication.external_symbols (mirrors TSExternalSymbol). The analyzer
classifies every call-graph endpoint not declared in the symbol table as an
external. The Neo4j projection emits :PyExternal authoritatively from that set,
so an imported module name (a :PyPackage) can no longer shadow a call target and
silently drop the PY_CALLS edge. :PyExternal gains a module property
(SCHEMA_VERSION 1.0.0 -> 1.1.0, additive). Node identity is also keyed by
(merge_label, value) so deferred PY_EXTENDS / PY_RESOLVES_TO edges cannot be
shadowed. Fixes the ~3.7% of call edges (targets like os/re/json) that were
dropped from the emitted graph.

#45 -- scope the bolt full-run prune to the application anchor

The full-run orphan prune deleted any :PyModule not in the current emit across
the entire database, so a push for application B wiped application A's modules.
The prune is now anchored:

MATCH (:PyApplication{name: $app})-[:PY_HAS_MODULE]->(m:PyModule)
WHERENOTm.file_keyIN $presentOPTIONALMATCH (m)-[...]->(x)
DETACHDELETEx, m

so it only removes that application's vanished modules. A single Neo4j database
can now hold multiple applications via full-run --emit neo4j.

#46 -- add --no-venv

New --no-venv/--venv flag (AnalysisOptions.no_venv). When set, skip venv
creation and dependency installation and resolve imports against the ambient
interpreter (self.virtualenv stays None). Useful in CI / containers where the
deps are already installed, for sandboxed runs without network, and for speed.

Testing

• Schema conformance + a Add first-class external_symbols (codeanalyzer-typescript parity); fixes dropped call edges to imported module names #44 regression test (call to an imported module name is
  preserved as a :PyExternal) -- pass.
• Bolt container tests via Testcontainers/podman, including a --emit neo4j (bolt) full-run orphan prune is global — wipes other applications' modules #45 regression
  (a full-run push for app-b leaves app-a intact) -- 4 pass against real Neo4j.
• A Add a --no-venv flag to skip virtualenv creation/installation #46 CLI regression (no virtualenv created, analysis.json still produced) --
  pass.
• End-to-end: analyzing "import os; os.getcwd()" yields
  external_symbols: {os: {name: os, module: os}} and the projection preserves the
  PY_CALLS edge to a :PyExternal {module: os}.
• schema.neo4j.json regenerated (1.1.0).

Closes

Closes#44
Closes#45
Closes#46
Closes#47