fix: entrypoints are advertised in the v1 schema but never populated #60

Problem

The v1 schema documents TSCallable.entrypoints as "non-empty ⇒ this callable is an entrypoint (level-2 finders populate)" and has a parallel class-level field. No finder populates either field: every builder initializes it to [], and there are no other writes in src/.

Top-level invocation roots are also absent from the call graph because calls without an enclosing function are skipped. As a result, consumers cannot identify application roots from the advertised entrypoint data or reliably derive them from incoming edges.

Reproduction

In the level-2 OWASP Juice Shop 6244c59 export:

• 1,257 records expose an entrypoints field (1,100 callables and 157 classes);
• 0 have a non-empty value.

Concrete startup example:

• app.ts defines app.app and invokes app() at module scope;
• the graph contains outgoing edges from app.app to startup functions;
• there is no module/top-level edge into app.app, and app.app.entrypoints is empty.

Implementation evidence:

• src/schema/schema.ts promises level-2 entrypoint population.
• src/syntactic_analysis/builders.ts hard-codes entrypoints: [] for normal callables, implicit constructors, and classes.
• src/semantic_analysis/jellyProvider.ts skips first-party callsites with no enclosing function (if (!callerFn) continue).

Expected behavior

Either populate the advertised contract or remove/deprecate it. If retained, entrypoint detection should represent at least explicit top-level invocations and define how framework entrypoints are discovered.

Acceptance criteria

• Decide and document v1/v2 entrypoint semantics.
• If retained:
  • record explicit module-scope calls into first-party callables as startup roots;
  • populate TSCallable.entrypoints for those roots;
  • add framework finders incrementally with an explicit detection_source (e.g. Angular bootstrap/routes, Express route registration, Nest decorators) rather than guessing;
  • project the same identity to JSON and Neo4j.
• If not retained, remove the field/comment from the contract instead of emitting a permanently empty field.
• Add a minimal fixture where a module-scope main() call results in one deterministic entrypoint, while an uncalled helper does not.