fix(python): extract defs nested in a function body and resolve bare names lexically (#1548)

[DeusData]

What

Python functions declare functions and classes inside their bodies: closures, app-factory route
handlers (def create_app(): ... @app.route("/") def index(): ...), decorator wrappers, test-local
classes. They were never extracted, so their calls hung on the enclosing function or the FILE node, their
route handlers vanished (no HANDLES), and a bare call to a local name was bound by a name guess to a
same-named definition somewhere else in the project.

• Extraction (extract_defs.c, extract_unified.c): a def or class nested in a Python function body,
  including inside its compound statements, is extracted with the QN <enclosing function>.<name>.
• Python LSP (py_lsp.c): a function's nested defs and classes are bound as locals of that function
  (LEGB); nested defs are walked with their own scope; a class declared in a function is walked under the
  function's QN.
• Registry (registry.c): a def declared inside a function body of its own file is registered for exact
  lookups only and kept out of the short-name index, so no weak strategy offers it to code elsewhere. The
  check is bounded at the symbol's own file (cbm_pipeline_fqn_symbol_prefix_len): a package
  __init__.py function can share a submodule's QN (poetry: layouts/__init__.py def layout vs
  layouts/layout.py). Every registration path (sequential, parallel, incremental seed) goes through
  cbm_registry_add_lang_in_module; cbm_registry_add_lang keeps its signature and does no local
  detection.
• Resolution: a new lexical_scope step runs after the LSP in both call resolvers (one entry point,
  cbm_registry_resolve_call_scoped) and for route-handler arguments: a bare name resolves to the def
  bound in the nearest enclosing function, stopping at the caller's module; exact lookups only.
• Import fallback (pass_pkgmap.c): the symbol-name fallback never binds an import to a function-local
  def of the same file.
• TESTS (pass_tests.c): a call from a def nested inside a Python test function is attributed to the
  nearest enclosing test function of the same file (before, such calls hung on the test FILE node).

No index-format change.

Evidence

Base origin/main 9f85f10 vs this head, 26 Python repos (manifest v1), production builds, macOS arm64,
--repeat 2, every repeat byte-identical.

type	base	this PR	+added	-removed
DEFINES	2,461,759	2,515,174	53,415	0
CALLS	1,326,684	1,354,959	47,539	19,264
USAGE	1,654,225	1,672,257	34,974	16,942
CALL_REFERENCE	14,970	26,924	11,965	11
DECORATES	233,412	243,846	10,434	0
INHERITS	68,723	78,598	9,875	0
DEFINES_METHOD	389,610	397,865	8,255	0
OVERRIDE	79,984	82,497	2,513	0
TESTS	505,546	511,518	12,284	6,312
HANDLES	1,740	2,328	598	10
DATA_FLOWS	0	80	80	0

Sampled and read, per stratum:

• New definitions and their own edges (DEFINES, DECORATES, INHERITS to their bases, CALL_REFERENCE as
  callbacks): correct in the samples (test-local classes inherit BaseModel, django Model, Entity,
  BaseOperator; local callbacks are referenced). One weak case: a base that is a function-local variable
  (Base = declarative_base()) still resolves by name.
• Re-attribution: calls inside nested defs now start at the nested def instead of the FILE node or the
  enclosing function; the removed CALLS / USAGE / HTTP_CALLS from .py file sources reappear from the
  nested defs with the same targets.
• Local-first binding: bare calls to a locally defined name bind the local def (lexical_scope +2,731,
  lsp_* through the LSP's local binding); the removed unique_name / suffix_match edges were wrong
  guesses for those names (test-local C(), Model(...), SelectApp(), post_image() bound to
  unrelated same-named definitions).
• HANDLES +598: route handlers declared inside app factories and test functions; a local homepage /
  endpoint wins over a same-named module function or method.
• TESTS, classified on the extraction change alone (the commit before the TESTS attribution): 6,315
  removed = 1,374 from function sources (1,367 of them wrong targets that are gone because the call now
  binds the test-local def) + 4,941 from test FILE nodes, which existed only because a call inside a
  test's nested helper hung on the file. With the enclosing-test-function attribution (this head), 4,128
  of those 4,941 (83.5%) are TESTS again, now from the test function; net TESTS +5,972 vs base. Residual:
  813 (0.16% of 505,546) are calls from helpers nested in NON-test functions of test files (fixtures,
  setup helpers, snapshot makers, private test-class helpers); like a module-level fixture or helper, such
  code is not a TESTS source.
• L7's collision check (poetry, the 11 defs whose nearest callable QN prefix lives in another file): their
  inbound CALLS 6 / IMPORTS 2 / INHERITS 1 / USAGE 3 are identical to base; without the own-file bound the
  2 IMPORTS were lost.
• Full == incremental (poetry): plain incr identical on every edge type; incr-n5 / incr-seq-n5 show
  +39 DEFINES from edited __init__.py File nodes to the synthetic <python-builtins> stubs, and base
  shows the identical +39: a pre-existing incremental defect, not changed here and tracked separately
  (repro: re-index after editing a package __init__.py adds DEFINES from that File node to the 13
  builtins stubs, 13 x 3 edited files on poetry; a full index has none).

Exposed approximation (documented, not changed here)

• DATA_FLOWS +80 (base 0): DATA_FLOWS pairs any HTTP_CALLS caller with any HANDLES handler of the same
  route node, and route nodes are keyed by method + path globally, not per app. The newly extracted
  test-local handlers (e.g. a camera test's stream_handler on its own test server) now pair with other
  tests' HTTP calls to the same path; 10 of 10 sampled are links between separate apps. A follow-up for the
  route model: pair caller and handler only within the same app / registration scope.

Tests

• Extraction, registry and pipeline tests for Python: defs nested inside a function are never extracted — app-factory (create_app) codebases lose their entire HTTP layer, and inbound traces silently return zero callers #1548 (app-factory routes, nested defs as function locals,
  local classes, imports never binding a local def, local-first shadowing in both orders, nested classes
  in defs), all on the sequential and parallel resolvers.
• registry_python_local_bound_at_own_file_issue1548 (both registration orders) and
  pipeline_python_init_function_shares_submodule_qn{,_parallel}_issue1548 (src/ layout: the import and
  calls onto Layout survive a full index and an incremental re-index): RED with the own-file bound
  removed.
• pipeline_python_nested_helper_keeps_tests{,_parallel}_issue1548: RED with the TESTS attribution
  reverted.
• Two existing expectations changed deliberately:
  • pylsp_nested_and_local_classbody_calls_join_extracted_caller asserted that a class declared in a
    function body is not a def -- the behaviour Python: defs nested inside a function are never extracted — app-factory (create_app) codebases lose their entire HTTP layer, and inbound traces silently return zero callers #1548 fixes; it now asserts the local classes are defs.
    Its call-site expectations (class-body calls join the enclosing function) are unchanged.
  • The shadowing test's local def under if True: is bound by lexical_scope, not by the LSP: at a
    compound statement's join the LSP invalidates what the branch bound. The asserted target is unchanged
    (the local def, never the module def); a later LSP walk of compound statements may move it to an
    lsp_* strategy deliberately.
• Affected suites (complexity, extraction, registry, pipeline, cross_repo, py_lsp,
  lsp_resolution_probe, incremental) pass.

Closes #1548.