Incorporate codeanalyzer-python v1.3.0

[rahlk]

Is your feature request related to a problem? Please describe.

A new codeanalyzer-python release (v1.3.0) is published. Update the codeanalyzer-python pin in this repo and adapt the integration to the changes below (see PyCodeanalyzer._run_analyzer).

Describe the solution you'd like

Not stated in the original issue.

Describe alternatives you've considered

Not stated in the original issue.

Additional context

[1.3.0] - 2026-08-29

Added

• Schema v2 now captures non-code artifacts (application.artifacts), declared dependencies with provenance (application.dependencies), and undeclared imports (application.unresolved_imports) at every analysis level (feat: add per-variable field initializers from codeanalyzer 2.3.8 #157). Neo4j gains language-neutral :Artifact/:Package nodes (purl ids) joined to the existing :PyExternal ghosts. New flag: --resolve-installed. Lockfile-only (transitive) pins are emitted as direct: false dependency records attributed to the lock artifact (Python analysis parity with Java (codeanalyzer-python backend) #152 reconciliation).
• Artifact discovery never drops a file: every non-.py file is now inventoried, matched or not (unmatched decodable files as text/unknown, anything not UTF-8 decodable as binary with empty source). New PyArtifact.text_truncated field plus --artifact-text/--no-artifact-text and --artifact-text-max-bytes flags control verbatim source capture; sha256/size_bytes always reflect the full file regardless (feat: add per-variable field initializers from codeanalyzer 2.3.8 #157).
• The release workflow now also stages schema.cypher (the same Neo4j schema contract as runnable, ;-terminated Cypher DDL -- uniqueness constraints plus indexes) as a GitHub Release asset alongside schema.json.
• Configuration keys extracted as first-class ConfigKey nodes from six v1 formats (.env, yaml, json, toml, ini, properties), with reference recognition and DEFINES_CONFIG Neo4j projection; namespace discriminators per format (Python analysis parity with Java (codeanalyzer-python backend) #152).
• PY_USES_CONFIG edges from call sites to the ConfigKey they read, resolved in three deterministic tiers: literal keys at -a 2, single-literal def-use chains at -a 3, interprocedural parameter-passing chains at -a 4. Unresolved reads (non-literal keys, undefined keys) emitted in application.config_reads_unresolved with reasons; PY_READS_CONFIG_UNRESOLVED Neo4j projection (Source all codeanalyzer-* from PyPI; kill bundled bin/jar dirs #162).
• Deployment-env config-key namespaces: Dockerfile ENV/ARG directives (multi-key, legacy space form, backslash continuations, quoted values) and compose/k8s environment/env shapes are now extracted too. ENV and compose/k8s environment/env entries mint namespace env, so os.environ/os.getenv reads resolve against deployment-declared variables; Dockerfile ARG mints its own dockerfile namespace (build-time only, not env-detector-bindable). Compose/k8s recognition dual-mints alongside the plain yaml dotted-path keys, by design (Read-only Python Neo4j backend, per-language factory facade & typed backend configs (#160–#164) #165).
• The release workflow also ships the analyzing-canpy-graphs skill as versioned assets: analyzing-canpy-graphs-skill.tar.gz (SKILL.md plus the vocabulary and analyses references, Cypher-only) and the standalone SKILL.md, staged next to schema.json/schema.cypher.
• Call arguments carry literal evidence: PyCallArgument.value (JSON-encoded constants) and PyCallArgument.name (bare identifiers) at every level.

Fixed

• The SDG builder resolves callsites from L2-backfilled body callees (the deterministic linker-backed path) instead of Jedi's cache-sensitive callee_signature side channel, and the shared dataflow test fixtures build at level 2 -- removing a full-suite-only order dependence.