fix(neo4j)!: scope every destructive statement on the can:// id prefix; retire _module

[rahlk]

Closes #140. Implements the org spec 2026-09-02-prune-scope-on-can-id-prefix.md (epic codellm-devkit/.github#50) for TypeScript, matching python's #183.

The bug

The per-module purge matched (x:CanNode {_module: $m}). That predicate is true across languages and false across applications: two TypeScript projects in one database sharing a file key deleted each other's nodes for it. Found while implementing: the --eager purge, scoped on the bare application id can://typescript/<app>, never reached a can://javascript/ node at all — the JS namespace from #115 was invisible to it.

What changes

• Every destructive statement scopes on the can:// id: the node by equality, descendants by id + '/'. The separator is the point — a bare prefix also matches …/foo.tsx under …/foo.ts and appXtra under app. Applied to the --eager purge, the per-module purge, the orphan prune (bolt) and the snapshot wipe (cypher), each run once per namespace this analyzer emits.
• _module retired from the graph, the catalog (schema.neo4j.json) and its index. RowBuilder lifts it off the row into NodeRow.module, which only groups rows; the incremental diff is now keyed by module id inside the app prefixes, not by a file key that collides across apps.
• TSCanNode / JSCanNode markers on every node keyed by a can://<lang>/ id, with a range index on id each. Index anchors only — STARTS WITH seeks only on a range index, and property indexes are label-scoped. CanNode stays until neo4j: merge labels Application and CanNode are unprefixed — reconcile with the cross-repo prefix rule #95 retires it.
• Empty application refused on any push (the diff itself is app-scoped). The snapshot renderer emits no wipe — visibly, with a comment — when its rows carry no can:// application id, rather than STARTS WITH ''.

Verification

• Container test (Neo4j: scope destructive statements on the can:// id prefix; retire _module #140's acceptance): the same fixture pushed as sa and saX — every file key collides, and can://typescript/sa is a string prefix of can://typescript/saX — survives each other's --eager purge and prune, and no node carries _module. The existing vanished-module test was rewritten to find nodes by id prefix.
• Mutation-checked: dropping the / from the descendant prefix makes that test fail.
• No-container unit test pins the helpers, the marker injection, _module never reaching props, and the shape of every destructive statement including the snapshot wipe.
• Snapshot diff against main on sample-app: 415 lines each way, accounted for entirely by _module removals (398), marker-label additions (14) and the wipe header. No other property, label or edge changed.
• bun test green; container suite 5 pass; schema.neo4j.json regenerated; decisions recorded in .claude/SCHEMA_DECISIONS.md

Deviations from #140 as written

• SCHEMA_VERSION stays 2.0.0. Neo4j: scope destructive statements on the can:// id prefix; retire _module #140 calls for a MAJOR bump because a property is removed; chore(schema)!: collapse the schema version back to 2.0.0 #144 (and python's --app-name is not emitted as a name: the application object has no name field, so the graph anchor is unnamed #186, which pulled its 3.0.0 back) decided there is one version until every analyzer re-baselines together. Recorded as P5 in the decisions file.
• The SDK check: the python SDK's TypeScript Neo4j backend never reads _module — it still queries the v1 vocabulary (:Module, m.file_key, :Symbol {signature}), so it is out of step with v2 for reasons well beyond this change. Worth its own issue.