feat(callgraph): propagation tiers — vscode ledger to 99.72%

[rahlk]

Closes #100. Stacked on #99. Ledger: docs/design/specs/defuse-linker-joern-ledger.md (rounds 9–10).

What

Bounded propagation tiers over the defuse linker, driven by the vscode residual families — no fixpoint anywhere:

• Property-initializer attribution: class property initializers execute in the constructor — their call sites now belong to the ctor (explicit or implicit), and an initializer ARROW materializes as a class-scoped positional anon (signature ↔ containment aligned; the property-arrow known-gap closes). Instance-prop sites leave the module sweeps. Closed the whole Registry.as-in-field-initializer family.
• T4a property votes: template.onChange(...) where the receiver is a parameter votes over object-literal properties (method shorthand included) passed at that position.
• T4b chained returns: return makeInner() follows one resolved-internal level, memoized, cycle-guarded.
• T4c ctor-field chain: this.migrate(...) where the field arrives through the constructor (parameter property / this.f = param) resolves to the function values passed at the class's new sites — with ONE bounded parameter hop (register(key, cb) → new Migration(key, cb)) and module-scope resolved calls feeding the vote rounds, so registered callbacks' own write() sites resolve too. vscode's migrateOptions chain lands end-to-end.
• Comparator param-proof: Joern's method parameter tables ride the dump (streamed writer — the old single StringBuilder crossed the JVM's 2GB array cap at vscode scale); a residual whose target leaf-name is a parameter of the Joern caller is their parameters-as-callees fabrication wearing a real name — proven by their own tables, classified, never gated.

Numbers

• Corpus gate (enforced): 74/74, residual 0 — unchanged through every tier.
• vscode audit: 54,918 / 55,074 single-candidate real pairs (99.72%), residual 135 — every remaining pair in a classified family: residual Promise-executor shadows (~13), the static/instance signature-collision schema finding (11, design-mode item), escaped closure-locals (~55, python #150's staged tier), accessor/duck tails (~56).
• A/B determinism byte-identical; full suite + typecheck green.

DoD deltas

The issue's "residual < 100" target lands at 135 — the gap to 100 is entirely the three families above, each either design-gated (static grammar), python-#150-tier work (explicitly out of scope here), or Joern-side fabrications their own dump under-proves. Recorded in the ledger rather than force-fitted.