python-sdk 2.0 leg 2.5a: TypeScript on schema v2 — models, both backends on the 1.2.0 vocabulary, pin, probe #335

Is your feature request related to a problem? Please describe.

Spec: docs/design/specs/2026-09-06-leg-2.5-typescript.md (branch docs/leg-2.5-typescript, 6015858; PR pending). Facade decisions: .claude/FACADE_DECISIONS.md. Part of codellm-devkit/.github#55. Ships in 2.0.0-rc.3.

release/2.0 pins codeanalyzer-typescript==0.4.3 (schema 1.0.0). The TypeScript models are the v1 identity-only mirror; TSCodeanalyzer passes --tsc-only (removed at 1.0.0); TSNeo4jBackend queries :Symbol/:CallSite/:CALLS and scopes on _module — zero overlap with the v2 graph. Nothing on the branch can read a 1.2.0 artifact.

Describe the solution you'd like

• G4 lift first: move the language-neutral bounds/paging/validation helpers (check_*, reject_bare_string, check_selector, scope_paths, resolve_module_key, call_graph_scope, bounded_subgraph, EdgeOrder/edge_page, cursor codec, hop_sort_key, flow_path, slice_resolved, cone_sinks, as_slice_node, module_key_of, the SDG_RELS/VIA tables parameterised on P, module_dotted parameterised on the extension set) from cldk/analysis/python/backend.py / python/neo4j/reconstruct.py into cldk/analysis/commons/; Python re-imports; Python's suite unchanged in count and green on the 1.4.1 graph (bolt 7689).
• G1 models: cldk/models/typescript/ rewritten as a pydantic mirror of cants' src/schema/schema.ts at 1.2.0 — envelope, TSApplication with id/kind/param_in/param_out/artifacts/dependencies/unresolved_imports/entrypoint_report/config_*, unified types{} by kind, TSCallable{id, span, body, cfg, cdg, ddg, summary, …}, TSBodyNode, TSCallEdge{src,dst,prov,weight}; validated against a real 1.2.0 analysis.json at -a 1..4.
• G2 ABC: TSAnalysisBackend inherits AnalysisBackend[…] with P="TS", N="TS"; TSCodeanalyzer drops --tsc-only, requests the configured level, reads the v2 envelope.
• Neo4j backend on the 1.2.0 vocabulary: every statement re-pointed at the 16 labels / 23 relationship types; prefix scoping with two prefixes (can://typescript/<app>/, can://javascript/<app>/, TS-3) on every statement; _module used nowhere.
• G5 probe: required relationship types, the :Application anchor by id, analyzer_version floor 1.2.0 → GraphSchemaMismatch below it or for an absent application.
• Pin codeanalyzer-typescript==1.2.0 in dependencies and [tool.backend-versions].
• Existing accessors green on the live superset graph (bolt 7690): Tier A, the 1.x leaf accessors (G3), the four feat(typescript): the four bulk/projected accessors — parity with Python's #180/#181 surface (#298) #302 bulk accessors, get_external_symbols; live dual-backend parity for each; the raising get_entry_point_methods/get_service_entry_point_methods removed (replaced in 2.5b).
• A multi-application audit for TSNeo4jBackend in the leg-1.6 shape (class-level and inline statements), with a fake two-application graph carrying no _module.
• CHANGELOG [Unreleased]: pin bump, the refused-graph behaviour, the removed raising accessors.

Describe alternatives you've considered

Not stated in the original issue.

Additional context

Caveats

• The 1.2.0 wheel's compiled binary cannot start its dataflow workers (cants Reachability API: forward reachability (given a source, find all reachable sinks) #171) — analysis still completes, sequentially. Local emits for the reference graph use the source build; the pin is the wheel.
• main stamps analyzer_version 1.2.0 on post-1.2.0 graphs (cants Reachability API: reverse reachability (given a sink, find all sources that reach it) #172); until that is fixed the probe cannot distinguish them. 2.5a's floor is 1.2.0 either way.
• Do not touch the query surface (2.5b): addressing, scoping keywords, per-callable pages, slices, paths, entrypoints, artifacts. This item makes TypeScript readable on v2 again with what it already had.
• Port 7687 on the development machine is an ssh tunnel; never a target. tests/analysis/typescript/test_typescript_neo4j_backend.py is live-gated on CLDK_TEST_NEO4J_* — check whether it emits before running it against a graph anyone cares about.

Definition of done

• Offline suite ≥ today's count; Python live suite on 7689 unchanged after the lift; TypeScript live suite on 7690 green; both contract tests green; tests/test_public_surface.py unchanged for Python.
• grep -c _module cldk/analysis/typescript/ is 0 outside prose.
• Attaching TSNeo4jBackend to a 0.4.3-shaped graph (fake driver) raises GraphSchemaMismatch.
• One PR to release/2.0, closing this issue.