F4: local-backend rewires — cants CLI + codeanalyzer-python 0.4.x, envelope validation, lockstep pins

[rahlk]

PROBLEM

The TS backend invokes the old analyzer CLI at pin 0.4.3; the Python backend calls codeanalyzer-python 0.3.0 in-process. Both must move to the v2 analyzers and validate the v2 envelope on load.

SCOPE BOUNDARY

Local backends only — Neo4j backends are F5; the Java backend is untouched here (Java lane, #228).

GOALS

1. TS subprocess -> cants CLI: -a 1..4, --graphs, --app-name, --call-graph-provider/--tsc-only, --no-phantoms, --cache-dir; exact version pin.
2. Python in-process invocation updated to codeanalyzer-python 0.4.x; exact pin.
3. Envelope validation on every load: clear, actionable error on schema_version mismatch (points at the pin and the fix).
4. Retires tsc_only=True hard-fails on default install: codeanalyzer-typescript pinned to 0.4.1 but --tsc-only needs >= 0.4.2 #175 (tsc-only pin skew). Re-verify Cached analysis.json not invalidated when tsc_only (resolver mode) changes — stale call graph returned #177 (resolver-mode cache invalidation) against cants' content-hash cache; close or re-scope it with evidence.

CAVEATS AND KNOWN RISKS

• LOCKSTEP: bump a pin only after the upstream v2 release is actually cut (cants 2.x; codeanalyzer-python 0.4.x on PyPI). Until then, develop against local builds via the env-var override.
• Subprocess timeouts (fix: enforce timeouts on analyzer subprocess invocations #198) must already be in place from the 1.x P0 floor; carry them forward on the new invocation.

DEFINITION OF DONE

• F1 replay green against the live v2 analyzers for TS + Python.
• A deliberately mismatched-schema payload fails with the actionable message.
• tsc_only=True hard-fails on default install: codeanalyzer-typescript pinned to 0.4.1 but --tsc-only needs >= 0.4.2 #175 closed; Cached analysis.json not invalidated when tsc_only (resolver mode) changes — stale call graph returned #177 verdict recorded.

Part of #238

[rahlk]

Heads-up for the pin here: the analyzer release that carries schema v2 (and the #98 keystone conformance sweep) will ship as codeanalyzer-python 1.0.0, not 0.4.x — the maintainer re-staged the version to mark the canonical contract stable (codellm-devkit/codeanalyzer-python#88, commit 750de57). F4's pin target should read codeanalyzer-python==1.0.0. The hand-off bundle in docs/handoff/ is regenerated keystone-shaped with analyzer.version: 1.0.0.