feat(entrypoints): base-class matcher with transitive heritage, dispatch and via (unit 4)

[rahlk]

Problem

Decorator- and call-declared entrypoints are covered (#157). Class-declared ones are not: a
framework whose entrypoints are "subclass this and define these methods" — Django's class-based
views, DRF's APIView/ViewSet in python; any TypeScript framework with a routed base class — has
no matcher, so bases: rules in a rules file load but never fire.

Unit 4 of docs/design/specs/entrypoint-detection.md
(#150), Task 6 of the plan.

Scope boundary

The base-class matcher only: entrypointsFromBases with transitive: heritage walking, dispatch:
method records, and via:. No new shipped framework rules — NestJS and Angular are decorator-only,
so the matcher is exercised through a user rules file in the test. File conventions and manifests
are unit 5.

Goals

• A rule matches when ANY base of the class — resolved through the import table, else as written
  — matches rule.match
• transitive: true also checks the bases of every in-project ancestor reachable through
  extends_ids
• The class gets one record (evidence: cls.signature); each dispatch: name the class DEFINES
  gets a record with rule: "<id>.dispatch", via: cls.id, and http_methods: [NAME] when
  NAME is an HTTP verb — a ListView with only get gains no phantom post
• Runs under the stage-0 gate like every framework rule

Caveats and known risks

• base_classes holds an in-project SIGNATURE when the checker resolved the base and the WRITTEN
  spelling otherwise; the resolver must be identity on already-qualified input
• An external ancestor has no node, so transitive walking stops at the project boundary — the direct
  base of the last in-project class is what matches
• The dispatch intersection depends on how cls.callables is keyed; verify against a fixture rather
  than assuming get is keyed get

Definition of done

• Direct base via import table, dispatch only for defined methods, via = class id — asserted
• Transitive: an in-project ancestor's base matches; a non-verb dispatch name yields http_methods: []
• The gate still applies: no import or dependency for the framework → nothing registers
• bun test green