feat(java): take up codeanalyzer-java 3.1.0 — config-read tiers and the entrypoint report

[rahlk]

Closes #369.

codeanalyzer-java 3.1.0 adds config-read tiers (upstream #233, #237) and the entrypoint report (#235). get_config_readers and get_unresolved_config_reads stop returning [] unconditionally, and get_entrypoint_coverage stops reporting the report unavailable.

The models were the task

A 3.1.0 payload failed JApplication validation with 1,368 errors across five fields — entrypoint_frameworks on every JCallable and JType, plus entrypoint_report / config_uses / config_reads_unresolved on the application root. extra="forbid" is why that surfaced as a loud failure instead of silently dropped data.

Added JEntrypointReport, JConfigUse, JConfigRead, mirroring the wire — which spells them exactly as Python's PyApplication already does.

The four accessors are implemented once on JavaAnalysisBackend over the canonical JApplication, which JNeo4jBackend now rebuilds with the overlays in it; both per-backend return [] stubs are gone. prov surfaces the tier rather than flattening it, so a caller can tell a literal read at the call site from one inferred over the DDG.

The refusal probe is not the config layer's absence

The obvious probe is wrong in both directions, and I measured why:

• The analyzer writes config_uses / config_reads_unresolved only when non-empty — the a4 fixture is a real 3.1.0 level-4 run over a tree that reads no configuration, and carries neither key.
• The graph declares the two relationship types only once an edge exists.

Either would refuse a clean 3.1.0 analysis that genuinely reads nothing — an ambiguous empty of exactly the kind this closes. The witness used instead is the sibling overlay from the same release: 3.1.0 writes an entrypoint report on every run; 3.0.x writes none of the three. One probe, no version literal, both directions pinned.

Verified, not assumed

• Relationship spellings: no parity violation. Read off a graph emitted with 3.1.0: J_USES_CONFIG and J_READS_CONFIG_UNRESOLVED. The JAVA_ prefix mentioned on codeanalyzer-java#231 did not ship. Agrees with PY_* and TS_* on the concept, differing only by each language's own node prefix.
• Comments are still blocked. 3.1.0 closes two of TSExternalSymbol has multiple versions #231's three asks: :JComment is a declared label with zero nodes, and only a declaration's docstring reaches the graph. remove_all_comments stays in RAISING and the file-keyed Neo4j comment accessors keep refusing, recorded as a standing limitation.

Upstream regression found and filed — codeanalyzer-java#240

3.1.0 makes the level-4 points-to tier depend on --external-calls, which was unconditional before:

run	ddg	points-to
3.0.3 -a 4	10,430	1,134
3.1.0 -a 4	10,154	858
3.1.0 -a 4 --external-calls	10,430	1,134

--emit neo4j forces the flag and the in-process backend never passes it, so the graph is now a strict superset of the payload by 276 edges and the same slice reaches further over Neo4j. Three live tests moved from equality to containment plus exact size plus all-points-to. Measured and recorded rather than worked around.

One contract test carries an argued exemption

test_generic_methods_are_all_abstract_on_the_java_contract requires every generic-ABC method to stay abstract, which conflicts with answering the config layer once for both backends. Exactly those two are excluded by name, and a new test asserts by identity that neither backend overrides them — a more direct guarantee of the property that matters than "is abstract" was, and one that goes stale loudly if the design changes.

Verification

Full gate 1584 passed, 367 skipped, 85.27% (baseline 1571 / 367 / 85.22%). Java live against the re-emitted two-application 3.1.0 graph with every gate satisfied: 728 passed, 2 skipped. Both fixtures regenerated with every published README figure re-measured — nothing moved but the version stamp and the additive fields.