feat(callgraph): C/C++ module registry and include resolution

[shivasurya]

Summary

Adds the FQN foundation for the C/C++ call-graph builder.

• graph/callgraph/core/c_module_types.go — CModuleRegistry (file-prefix, includes, function index) and CppModuleRegistry (embeds C registry plus namespace and class indices).
• graph/callgraph/registry/c_module.go — BuildCModuleRegistry, BuildCppModuleRegistry, and BuildCIncludeMap walk the parsed CodeGraph and produce read-only registries.

FQN format

Shape	Example
C function	src/net/socket.c::connect_to_server
C++ free function (namespaced)	src/utils.cpp::mylib::process
C++ class method	src/socket.cpp::mylib::Socket::connect
C++ class method (no namespace)	src/app.cpp::App::run
C++ free function (no namespace)	src/main.cpp::main

Include resolution order

For #include \"...\", first match wins:

1. Directory of the source file
2. <projectRoot>/include/<header>
3. <projectRoot>/src/<header>
4. <projectRoot>/<header>

System includes (#include <...>) are skipped — they are owned by a future stdlib registry.

Design notes

• Method-to-class association uses byte-range containment within the same file. The registry never reads parser-internal context state, so it stays composable across future parser refactors.
• Files outside the project root (..-prefixed relative paths) are dropped at registry-build time.
• FunctionIndex deliberately preserves duplicates across header and source files so the call-graph builder can choose between declaration and definition.
• appendUnique dedupes per-key entries within a single file (defensive against repeated graph visits).

Test plan

• go build ./...
• go test ./... — full suite green (25 packages)
• go vet ./...
• golangci-lint run ./graph/callgraph/registry/ ./graph/callgraph/core/ — 0 issues
• Coverage: core 94.3%, registry 91.7% on the new files
• 9 spec test cases covered: empty graph, files+functions, duplicate across files, duplicate same file, outside project root, namespace+class index, method-without-namespace, on-disk include resolution (4 search dirs + system + missing), language filter, plus defensive paths (orphan method, empty header name, directory-named-as-header).

Stacked on

shiva/cpp-parser (#671)

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	4
Rules	205

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 87.28324% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.18%. Comparing base (1a773d0) to head (b9a6ef5).

Files with missing lines	Patch %	Lines
sast-engine/graph/callgraph/registry/c_module.go	86.41%	11 Missing and 11 partials ⚠️

Additional details and impacted files

@@                 Coverage Diff                  @@
##           shiva/cpp-parser     #672      +/-   ##
====================================================
+ Coverage             85.17%   85.18%   +0.01%     
====================================================
  Files                   178      180       +2     
  Lines                 26064    26237     +173     
====================================================
+ Hits                  22199    22351     +152     
- Misses                 3015     3024       +9     
- Partials                850      862      +12     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.