feat(helm): emit containment edges for resource templates, lookups, and aliases

[rahlk]

Closes #4. Contract side: codellm-devkit/codeanalyzer-schema#3 (commit b84428f). Spec: docs/design/specs/2026-09-05-iac-containment-edges.md in codellm-devkit/.github (#57). Epic codellm-devkit/.github#52.

What changes

• Pins the accepted schema commit b84428f1accebe2b259d32c15387f04a00167f2c everywhere (schema.json, schema.neo4j.json, embedded copies, live.yml, README, .claude/SCHEMA_DECISIONS.md), with a test that fails if any pin site drifts.
• Emits three identity-only containment edges at L1, monotone through L3: IAC_HAS_RESOURCE_TEMPLATE and IAC_HAS_LOOKUP_REFERENCE from a HelmTemplate to each child in resource_templates{} / lookup_references{}, and IAC_HAS_ALIAS from an Artifact to each entry in its aliases[].
• model.Validate enforces one edge per nested child, mirroring the existing value-reference rule. The Neo4j projector and eager cleanup pick the new families up from the catalog with no new code.
• README: edge documentation and the level table (resource templates are L1 facts).

Why

DayTrader's five *-service.yaml templates each hold a Service and a conditional Route document. Provenance (IAC_DERIVED_FROM) is attributed only for single-region files, so those ten HelmResourceTemplate nodes had no edge at all and were isolated in Neo4j. HelmLookupReference nodes were unreachable, and aliases had no inbound owner edge.

Evidence

After rewriting DayTrader (sample.daytrader.microservices@8a68b59, three profiles) into Neo4j:

MATCH (n) WHERE n.iac_app_id = 'can://iac/daytrader' AND NOT (n)--() RETURN count(n)
0

18 IAC_HAS_RESOURCE_TEMPLATE edges for 18 resource templates, 1 IAC_HAS_ALIAS. Gates: gofmt, go vet, go test ./..., -race on helm/model/neo4j, make schema-check, jobs-determinism and level-subset ×5, semantic checker on fresh L1/L2/L3, Neo4j parity suite with CI=true, make test-live (DayTrader containment assertion included).