Emit IAC_HAS_RESOURCE_TEMPLATE, IAC_HAS_LOOKUP_REFERENCE, IAC_HAS_ALIAS containment edges

[rahlk]

Plan (optional)

Spec: docs/design/specs/2026-09-05-iac-containment-edges.md in codellm-devkit/.github (PR codellm-devkit/.github#57), §5 "codeanalyzer-iac". Contract side: codellm-devkit/codeanalyzer-schema#2.

Problem

The accepted catalog gains IAC_HAS_RESOURCE_TEMPLATE, IAC_HAS_LOOKUP_REFERENCE, and IAC_HAS_ALIAS. Until the analyzer emits them, HelmResourceTemplate nodes of multi-document template files (for example DayTrader's five *-service.yaml) are disconnected islands in Neo4j, HelmLookupReference nodes are unreachable, and IaCAlias nodes have no inbound owner edge. The analyzer also fails the updated semantic checker on any chart.

Scope boundary

In: re-pin schema.json / schema.neo4j.json (and embedded copies) to the accepted schema commit; three Relationship constants; L1 emission in the Helm Parse edge loop and the chart alias patch; model.Validate counterpart invariants; accepted-edge test fixtures; L1/L2/L3 and parity tests; live DayTrader assertion (every resource template has exactly one inbound containment edge); README edge table; .claude/SCHEMA_DECISIONS.md D1–D4.
Out: the single-region provenance rule; any node-shape change; release pipeline (#3).

Goals

• make schema-check byte-equal to the accepted schema commit.
• Every resource_templates, lookup_references, and aliases entry has exactly one containment edge from its owner at L1, preserved at L2 and L3.
• Updated check_iac.py (driven as in tests/live/acceptance_test.go) passes on fresh L1/L2/L3 output and on both live corpora.
• DayTrader graph write leaves zero isolated nodes for iac_app_id = can://iac/daytrader.
• --jobs byte-identity and filesystem/graph parity unchanged.

Caveats and known risks

• Depends on the schema commit being accepted first; the branch pins that commit.
• lookup_references has no live-corpus exercise; coverage comes from testdata and unit fixtures.
• Lands on main before the v0.1.0 tag (spec D4), after codeanalyzer-iac#2.

Definition of done

• All gates in the analyzer README pass locally, including make test-live and the Neo4j parity suite with CI=true.
• Zero isolated nodes proven with a Cypher count in the PR description.
• Closed by one PR against main (after feat: Helm-first unified IaC backend (L1–L3, filesystem and Neo4j) #2 merges) or rebased onto main.