Record this analyzer's schemas in codeanalyzer-schema on release

[rahlk]

Is your feature request related to a problem? Please describe.

Spec: docs/design/specs/2026-09-09-schema-uptake-on-release.md · Epic: codellm-devkit/.github#73

This repo's release workflow already emits its Neo4j graph contract as a release asset, but nothing carries either the contract or the analysis.json samples into the shared contract repo, codellm-devkit/codeanalyzer-schema. That repo refreshes by hand, which means late: on 2026-09-09 its copy of this analyzer was java 3.0.1 against a released 3.1.1, and across the three analyzers the python contract still declared a _module property that 1.4.1 had removed. Nothing is wrong with the analyzer; the record of what it emits drifts, silently, because nothing fails when it is stale.

Describe the solution you'd like

• A final step in the release job, gated on startsWith(github.ref, 'refs/tags/')
• Runs this analyzer on its own fixtures, staging each sample under the filename the contract repo keeps it under
• Publishes the graph contract to v<major>/neo4j/java/ and the samples to v<major>/json/java/, each <major> derived from that document's own schema_version
• Opens a PR from uptake/java-v<version>; a re-run of the same tag updates that branch rather than opening a second PR
• Fails with an explicit message if the token lacks contents:write on the contract repo

Describe alternatives you've considered

Not stated in the original issue.

Additional context

Scope boundary

One step at the end of the release job, gated on a tag. Does not change what this analyzer emits. Does not touch analysis.schema.json in the contract repo — that file is hand-written, not analyzer output. Does not add CI to the contract repo to gate the resulting PRs; that is left open in the spec.

Caveats and known risks

• The token is ORG_DISCUSSIONS_TOKEN, already used cross-repo by these workflows. The repos describe its scope inconsistently, so it may lack contents:write on the contract repo; the step names CLDK_AUTH_TOKEN as the documented repo-scope alternative when it fails.
• The step adds fixture runs to release time.
• It cannot be exercised without pushing a tag, so the first real release is its first test. It is gated and last in the job, so a failure there cannot affect the published release.

Definition of done

• A tagged release opens a PR on codeanalyzer-schema containing only this analyzer's files, at paths matching that repo's existing layout.
• python3 scripts/check.py passes in the contract repo with the PR applied.