Take up codeanalyzer-java 3.1.0: config-read tiers and the entrypoint report

[rahlk]

Problem

codeanalyzer-java 3.1.0 closes codeanalyzer-java#231 and adds a tier beyond it:

upstream PR	what it adds
#233	config-read literal tier — J_USES_CONFIG and J_READS_CONFIG_UNRESOLVED
#235	entrypoint report on the application root, framework attribution on the node
#237	config-read dataflow tiers — non-literal keys closed over the L3 DDG and the L4 call graph
#238	docs only

The graph contract stays at 2.0.0, so this is additive: no schema major bump, and a 3.0.x graph remains attachable.

Two SDK accessors currently degrade because this data was absent:

• get_config_readers() returns [] unconditionally — the ambiguous empty the SDK refuses everywhere else.
• get_entrypoint_coverage() reports entrypoint_report_unavailable, because keys(:JApplication) was exactly analyzer_name, analyzer_version, name, schema_version.

Two things to verify, not assume

1. The relationship name. PR fix: remove extra TSExternalSymbol fields #233's title says J_USES_CONFIG / J_READS_CONFIG_UNRESOLVED, but a comment on codeanalyzer-java#231 says the parity-clause spelling for Java is JAVA_READS_CONFIG_UNRESOLVED. Read the emitted graph and use what is actually there. If the two analyzers disagree on the spelling of the same concept, that is a parity-clause problem worth reporting upstream before we encode either.
2. Comments. codeanalyzer-java#231 asked for three things and the PR list covers two. If the projection still has zero comment nodes, remove_all_comments and the Neo4j comment accessors stay blocked and stay in RAISING — confirm which, rather than assuming the issue closing means all three landed.

Scope boundary

In scope: the pin, the two accessors above, whichever comment accessors 3.1.0 actually unblocks, re-emitting the reference graph, and the docs entries that no longer hold.

Out of scope: codeanalyzer-java#187 (CRUD), and get_service_entry_point_*, which is SDK work with no upstream dependency.

Goals

• Pin at codeanalyzer-java==3.1.0, both places in pyproject.toml
• get_config_readers and get_unresolved_config_reads answer, on both backends, with the dataflow tier distinguishable from the literal tier
• get_entrypoint_coverage answers instead of reporting the report unavailable
• A graph emitted below 3.1.0 still refuses rather than answering an empty — measured from the data, never from a version literal, as the port probe does
• Reference graph re-emitted, live suite green, committed fixtures regenerated if their measured figures move

Caveats and known risks

• Keep the refusal path. The Neo4j floor is 3.0.1; a 3.0.x graph is attachable and carries none of this. This is the same ruling as the port probe and the TypeScript 1.4.0 uptake (Take up codeanalyzer-typescript 1.5.0: binding layer, UTF-8 spans, per-facet ids #368).
• The dataflow tier (Honor a system/global JDK instead of downloading Temurin per analysis cache #237) is a derived answer — a key reached over the DDG is not the same evidence as a literal at the call site. If the projection distinguishes the tiers, the SDK should surface that rather than flatten it; if it does not, say so.
• Regenerating the committed fixtures moves published numbers in tests/resources/java/analysis_json/v2/README.md. Re-measure rather than editing figures by hand.

Definition of done

• Both accessors answer on a 3.1.0 graph and refuse on a 3.0.x one, pinned by tests, with no version literal in the decision path.