feat: preserve runtime dependency provenance

[shaggitza]

Summary

Phase 1 of #277: preserve authoritative declared FastAPI dependency provenance in runtime extraction and use exact source-attested providers as mypy propagation roots.

• adds optional frozen schema-v1 EndpointDependencyGraph evidence while retaining the legacy Endpoint.dependencies projection unchanged;
• recursively records ordered FastAPI Dependant occurrences, including qualified physical callable identity/source, scope, cache semantics, Security scopes, partial/callable structure, nesting, duplicates, and graph-local limitations;
• distinguishes None (not collected) from established-empty, conditional, and unavailable graphs without weakening route-discovery status;
• applies deterministic depth/node/work/metadata limits, cycle handling, effective-route fallback, malformed-shape isolation, and declared-only override warnings;
• seeds mypy only from exact project-local function/bound-method occurrences whose physical runtime source overlaps the unique typed definition;
• includes the complete graph in analysis cache identity, preventing stale no-graph/runtime-graph reuse;
• exposes the additive graph in JSON/YAML, bumps inventory/report schema to 3 and private runtime-worker protocol to 2, and documents compatibility.

This closes a concrete false negative: app/include-level dependencies and independently established nested providers can now propagate through their helper calls. In the DI example, POST /items is correctly affected through check_scope -> get_current_user -> decode_token.

Fail-closed behavior

• Runtime IDs/reprs are never serialized.
• Wrappers that merely copy metadata are not treated as the wrapped function.
• Partials and callable instances are descriptive but are not mypy seeds.
• Unsupported iterable/metadata shapes are never executed or eagerly materialized.
• Caps and malformed metadata condition only dependency evidence; they do not remove or downgrade established routes.
• Visible dependency overrides condition the declared graph rather than pretending to model request-time effective providers.
• FastAPI 0.100 legacy inherited security scopes remain depends_or_security, not falsely classified as declaration-local Security.

Scope

This tranche intentionally does not modify secure-AST extraction, route assembly/source ownership, baseline/target lifecycle reconciliation, effective dependency overrides, or general callable points-to/dataflow. #277 remains open for those later phases.

Validation

• 110 focused model/formatter/runtime/mypy tests passed on current FastAPI 0.139.0.
• Focused provenance and malformed-metadata tests passed on minimum FastAPI 0.100.0.
• All 70 resource-isolated repository test files passed locally excluding two known platform-sensitive broker files:
  • tests/benchmarks/test_pilot_typed_run_v3.py (posix_spawn(..., setsid=True) unavailable locally);
  • tests/benchmarks/test_ground_truth_run_v1.py process-limit child spawn is unreliable under the active local agent fleet.
• Ruff format/check passed for all src and tests files.
• strict mypy passed all 41 source files.
• Terminal independent review returned PASS with no remaining blocker/high finding.

GitHub Actions is authoritative for both platform-sensitive benchmark files and the Python 3.10–3.12 matrix.