Take up codeanalyzer-typescript 1.5.0: binding layer, UTF-8 spans, per-facet ids

[rahlk]

Problem

codeanalyzer-typescript 1.4.0 closes codeanalyzer-typescript#182: the Neo4j projection now carries import/export bindings, parameters_json on callables, and unresolved config reads. Three python-sdk accessors currently refuse on a TypeScript graph because that data was absent, and each refusal is asserted by a test that must now be inverted.

accessor	today, on a 1.3.0 graph	on 1.4.0
get_imports / get_exports	raise, naming "no import bindings" / "no export bindings"	should answer
get_method_parameters	raises over Neo4j, answers in process	should answer on both
get_config_readers / get_unresolved_config_reads	[] / refuse	should answer

Scope boundary

In scope: pin 1.4.0, re-emit the reference graph, make the four accessors answer, invert the tests that assert their refusal, and update the documented lossiness that no longer applies.

Out of scope, still open upstream: #177 (declaration-merge id collision), #179 (:TSCallable.code one line short), #180 (structuredClone ceiling), #181 (exit 0 on failure). None is fixed in 1.4.0.

Goals

• Pin at codeanalyzer-typescript==1.4.0, both places in pyproject.toml
• The four accessors answer, identically on both backends, on a 1.4.0 graph
• A graph emitted below 1.4.0 still refuses rather than answering an ambiguous empty — the decision measured from the data, never from a version literal, as the Java port probe does
• The reference graph is re-emitted and the live suite green against it
• docs/agent-api-reference.md and the CHANGELOG's ### Known limitations lose the entries that no longer hold

Caveats and known risks

• Do not delete the refusal path. The graph floor is a real boundary: a 1.3.0 graph is still attachable and still has no import bindings. Follow the pattern leg 3 established for Java's port probe — ask the data whether it carries the thing, never ask the analyzer's version.
• Re-emitting the TypeScript reference graph destroys and rebuilds it; do the offline half first.
• parameters_json is a JSON string on the node. Decoding it must not swallow a malformed value into [], which would recreate the ambiguous empty this closes.

Definition of done

• The four accessors answer on a 1.4.0 graph and refuse on a 1.3.0 one, both pinned by tests, with no version literal in the decision path.