feat: add tilth_deps — file-level dependency analysis

[jahala]

Summary

New MCP tool tilth_deps for blast-radius checks before breaking changes. One call shows what a file imports and what imports it, replacing 5-10 separate tilth_search kind:callers queries.

• Uses (local): files this file imports, with which symbols are used from each
• Uses (external): third-party packages (stdlib filtered out)
• Used by: downstream files that call this file's exports, with path:line Type.method → symbol format
• Budget-aware truncation: trims Used by → externals → local symbols → header only

Closes #17

Changes

File	What
src/search/deps.rs	New: core analyze_deps() + format_deps() with line numbers in used-by
src/mcp.rs	Register tilth_deps tool + dispatch + instructions
src/search/mod.rs	Add pub mod deps
src/read/imports.rs	Make is_external, is_import_line pub(crate)
src/search/callers.rs	Make find_callers_batch pub(crate), qualify caller names with enclosing type
Cargo.toml / npm/package.json	Bump to 0.4.9

Example output

# Deps: src/session.rs — 0 local, 0 external, 14 dependents

## Used by
src/cache.rs:25                default              → new
src/cache.rs:33                new                  → default
src/mcp.rs:97                  run                  → new, new, new, new
src/mcp.rs:276                 tool_read            → record_read, record_read
src/index/bloom.rs:378         tests.test_basic_membership → new
src/search/deps.rs:178         analyze_deps         → find_callers_batch

[~795 tokens]

Test plan

• cargo clippy — zero warnings
• cargo test — all tests pass
• Tested on core file (callers.rs) — correct local/external/dependents
• Tested on leaf file — 0 dependents shown correctly
• Tested barrel file detection (bloom.rs) — cap + note shown
• Self-references filtered (canonicalized path comparison)
• Stdlib imports filtered (std::, core::, alloc::)
• String literal garbage filtered (is_valid_module_path)
• Type-qualified caller names (e.g. tests.test_basic_membership)
• Line numbers in used-by output (e.g. src/cache.rs:25)
• MCP anti-overuse language in tool description and instructions

🤖 Generated with Claude Code