Improve evidence-backed FastAPI code graph topology

[forhappy]

Summary

• extract FastAPI WebSocket and api_route routes while preserving exact decorated handler identities
• resolve callable-instance, qualified, nested, and module-scoped dependency injection only from exact lexical/type/import evidence
• fix multiline Python call arity when inline comments occur inside argument lists
• publish role-promoted dependency/security route stages without admitting arbitrary variable endpoints
• add an evidence-backed topology regression policy to the code-graph-v1 qualification harness

Real FastAPI evidence

Verified against pinned FastAPI commit 0c2b6aafd7a2e3a5bf1055ea0ed0a41da15ba5f4:

• graph: 15,441 nodes, 25,215 edges, 1,116 communities
• 29/29 .websocket and 3/3 .websocket_route decorators represented
• 3/3 AST-observed api_route operations represented
• route oracle: 716 correct, 12 ambiguous, 0 missing; zero isolated FastAPI route nodes
• dependency oracle: 210 correct, 55 ambiguous, 1 missing, improved from 142/111/13
• 72 exact depends_on edges to 64 callable-instance variables
• exact solve_dependencies -> request_body_to_args core call restored
• zero publication omissions; cold and warm graphs were byte-identical

The one remaining missing dependency is a parametrized module.dependency_c expression with two possible runtime modules. It remains unresolved intentionally rather than guessing.

Compatibility

No package, lockfile, schema-version, CLI, or machine-contract version changes. Existing v1 contracts remain in place. No Graphify dependency was introduced.

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --lib --bins --locked -- -D warnings
• cargo test --workspace --lib --bins --locked
• ./scripts/qualify_code_graph_v1.sh --fixtures-only
• python3 -m unittest scripts.tests.test_code_graph_v1_oracle
• sh scripts/check_product_boundary.sh