feat: take up codeanalyzer-python 1.5.1, java 3.1.2 and typescript 1.5.3

[rahlk]

Takes up the three analyzer releases cut today. All three shipped the same fix in lockstep —
param_in and param_out edges now name the bound formal in var
(codeanalyzer-python#196, codeanalyzer-java#250, codeanalyzer-typescript#197).

pin	before	after
codeanalyzer-python	1.5.0	1.5.1
codeanalyzer-java	3.1.1	3.1.2
codeanalyzer-typescript	1.5.2	1.5.3

Why the fix matters, measured rather than argued

The schemas had declared var on those edges since the L4 layer landed and the projections wrote
nothing. A consumer predicate on it is therefore null on every edge crossing a call boundary, and
under Cypher's three-valued logic an all() over that null excludes the whole path — so an
interprocedural flow reads as a proved absence of flow. That is the ambiguous-empty failure this
surface exists to refuse.

Measured on a graph emitted by the previously pinned 1.5.0, before this bump:

relationship	edges	with var
PY_DDG	44	44
PY_PARAM_IN	4	0
PY_PARAM_OUT	6	0
PY_CDG	10	0
PY_SUMMARY	8	0

So this was the shipped state of rc.4, not a legacy-graph edge case.

The bump is not only a pin, and the suite said so

7 failures, two causes, neither of them noise.

JParamEdge needed widening. It declared only src/dst, so once 3.1.2 wrote var every param
edge failed extra="forbid" — 2515 validation errors on daytrader8, 2841 on the built copy:

application.param_in.0.var
  Extra inputs are not permitted [type=extra_forbidden, input_value='tSIA']

The field is Optional, because an analysis.json or a graph from 3.1.1 or earlier carries no such
key and both backends attach to artifacts they did not produce. TSParamEdge had already declared it,
so TypeScript's models needed nothing — the asymmetry was Java's alone. This is extra="forbid"
working as designed: the drift failed loudly instead of being silently dropped.

The four TypeScript level fixtures were stale. They were stamped 1.5.2, and the models test reads
the pin from pyproject.toml rather than hardcoding it, so they tripped the version guard that exists
for exactly this (its docstring notes leg 2.5b found it stale once already). Regenerated all four with
1.5.3 by the recipe their README documents. The diff is the fix and nothing else — on a4, param_in
went from 5 of 31 edges carrying var to 31 of 31 and param_out from 0 of 26 to 26 of 26, with no
top-level key added or removed at any level. The README's per-generation changelog records it.

No floor moves

Each delta is the var fix plus release plumbing, with no change to the can:// grammar — Java's
language-neutral externals merge sits below v3.1.1 and was already in rc.4's pin. Raising a floor
would refuse graphs that still work, since the fix only adds a property, and a capability difference
belongs in a data-measured probe rather than a version literal. (3,1,1) / (1,5,0) / (1,5,2) stay.

Gate

1597 passed, 370 skipped, no failures — the same count as before the bump.

Not in this PR

Five incorporation issues are open for pins long since taken up: #315 (1.2.0), #316 (1.3.0),
#317 (1.4.0), #325 (1.4.1), #377 (1.5.0). Only codeanalyzer-python's pipeline
auto-creates them and nothing closes them, so they accumulate. Worth closing as done — separately from
this change.

Also worth noting: Java's and TypeScript's release pipelines have no equivalent of Python's
notify-python-sdk job, so their releases prompt nothing here. That asymmetry is how a pin drifts
behind unnoticed.

Closes #384