bump codeanalyzer-python pin to 1.5.4 — the false-refutation fix (#204/#220), and the floor decision it forces #423

Is your feature request related to a problem? Please describe.

pyproject.toml pins codeanalyzer-python==1.5.3 (in dependencies and [tool.backend-versions]). v1.5.4 shipped 2026-09-16 and carries the fix for the defect this repo has been pinning as known-broken since leg 4b.

codeanalyzer-python#220 — a parameter passed as an argument now links across the call boundary. Reaching-def analysis names the synthetic CFG ENTRY node as the definition site of every parameter. build_formals remapped that onto the matching formal_in vertex; build_actuals did not, and wired actual_in ports straight from the raw source. So the graph held ENTRY -> actual_in:N where it needed formal_in:N -> actual_in:N. The return direction was wired correctly, and that asymmetry is the tell.

This is codeanalyzer-python#204, which this SDK measured from the other side and pinned:

• resolve_value returns the formal_in vertex, so a forward walk began at a vertex with no path to the argument port and never crossed PY_PARAM_IN;
• slice_forward stayed inside one callable; flows_to_call and flows_to_argument answered False; paths_between returned nothing;
• taint() published a clean refutation: zero paths, no diagnostic, depth is None, so all three of exhausted's conditions held and the pair was certified refuted for a flow visible in three lines of source.

Describe the solution you'd like

• dependencies pin → codeanalyzer-python==1.5.4.
• [tool.backend-versions] table → 1.5.4 (both must move together; they are read independently).
• uv.lock regenerated.
• test_the_first_call_a_caller_parameter_is_passed_to_is_still_falsely_refuted (tests/analysis/python/test_python_taint_live.py:369) is expected to go RED. It exists to fail when #204 is fixed. Rewrite it into its positive form: the first call a caller parameter is passed to is now reached, with a witness, and the pair is no longer certified exhausted. Keep the measured numbers in the docstring and say which analyzer release changed them.
• Re-emit the leg-4b taint fixture graph with the 1.5.4 wheel before running that tier; a 1.5.3-emitted graph still carries the wrong edges and will keep the old answer.
• Decide whether PyNeo4jBackend._ANALYZER_FLOOR moves. It is (1, 5, 0) today. A 1.5.3 graph now answers wrongly rather than less, which is a different argument from every previous floor discussion — a silent false refutation is the failure mode the floor exists to prevent.

Describe alternatives you've considered

Not stated in the original issue.

Additional context

Scope boundary

• Pin bump, the one test rewrite it forces, and the floor decision. No facade change, no new accessor.
• Neither 1.5.4 fix moves the schema: payload schema_version and graph SCHEMA_VERSION stay 2.0.0.
• The second 1.5.4 fix (codeanalyzer-python#219, http_methods carries HTTP methods only) has no Python-side SDK surface — http_methods exists on TSEntrypoint in the TypeScript models, not on the Python ones. Confirm no Python entrypoint assertion reads it.

Caveats and known risks

• The floor question is the real decision here, not the pin. Consumers attached to graphs emitted by 1.5.2 or 1.5.3 get false exhausted refutations from taint(). If the floor does not move, that stays true and silent. If it does move, graphs that answer every other query correctly are refused. Neither is obviously right; measure before choosing.
• Any test asserting the absence of an interprocedural flow on a re-emitted graph may now find one, and that movement is correct.
• [[project-neo4j-test-fixture]]'s gotcha 3 and the leg-4b measurements are superseded by this release, not merely dated.

Definition of done

Both pins read 1.5.4, uv.lock matches, the leg-4b fixture is re-emitted, the pinned test is rewritten to its positive form with fresh measurements, the floor decision is recorded with its reasoning in CHANGELOG.md, and the Python tiers are green against the 1.5.4 wheel.