Schema v2 foundation: artifacts, dependencies, unresolved imports

[rahlk]

GOALS

Implement docs/design/specs/2026-08-27-artifacts-and-dependencies-design.md — schema v2 foundation for non-code files:

• PyArtifact model + application.artifacts sibling map, can://artifact/<app>/<path> ids
• Discovery walk + shipped rules table (codeanalyzer/artifacts/discovery.py), broad capture with roles
• Dependency extraction (parsers.py, dependencies.py): requirements*.txt (with -r/-c), pyproject.toml (PEP 621 / Poetry / build-system), setup.py static-AST, setup.cfg, Pipfile(.lock), poetry.lock, uv.lock, environment.yml
• application.dependencies (prov: declared/lockfile/installed-metadata/heuristic) + application.unresolved_imports
• --resolve-installed flag (opt-in venv probing); default run byte-identical
• Neo4j: :Artifact / :Package (purl ids), HAS_ARTIFACT / DECLARES_DEPENDENCY / LOCKS / PY_PROVIDES / PY_UNRESOLVED_IMPORT, DDL constraints
• Fixture project with every manifest format; L1-data posture (identical at every -a)

Spec is the authority; schema decision recorded in .claude/SCHEMA_DECISIONS.md (2026-08-27 entry).

CAVEATS

• setup.py is static-AST only — computed dependency lists become extraction: "partial", never executed (determinism gate).
• Lock-only (transitive) packages deliberately out of scope; locks only backfill locked_version.
• Cross-analyzer artifact joins require agreed --app-name; recorded, not solved here.
• source unbounded by decision — revisit only with measured payload numbers.

DEFINITION OF DONE

• All spec §6 formats parsed on the fixture; prov and purl ids asserted.
• Sections identical at -a 1..4; monotonicity gate green.
• Two consecutive default runs byte-identical; --resolve-installed covered by one gated test.
• Neo4j rows + constraints covered by row tests; full suite green.
• Ships in 1.3.0 (additive minor).