Incorporate codeanalyzer-python v1.2.0

[rahlk]

A new codeanalyzer-python release (v1.2.0) is published.
Update the codeanalyzer-python pin in this repo and adapt the
integration to the changes below (see PyCodeanalyzer._run_analyzer).

[1.2.0] - 2026-08-26

Changed

• BREAKING: PyCG is removed; level 2 is Jedi + the defuse linker (#148).
  PyCG's whole-program fixpoint was the analyzer's cost pathology — on a
  2,364-file project a seed-pinned sharded run spent 3h19m without one of 17
  shards converging, and no setting of its knobs bounds a single pass — so it
  is gone wholesale: the pycg dependency, the sharding machinery, and the
  --pycg-shard, --pycg-shard-ceiling, --pycg-shard-strategy,
  --pycg-max-iter, and --pycg-shard-timeout flags (the never-released
  --call-graph selector is gone with them; there is one code path). Level 2
  call edges now come from Jedi plus a per-callable defuse linker that
  resolves remaining call sites through local def-use chains and module-scope
  bindings — deterministic, no global fixpoint. Call-edge prov values are
  now "jedi", "defuse", or both; "pycg" no longer appears (and is
  removed from the schema's prov literal). Design:
  docs/design/specs/2026-08-25-defuse-linker-call-graph-design.md.
• BREAKING: the msgpack output format is removed (Update Java Model to comply with codeanalyzer v2.3.1 #118, TS parity): the
  --format msgpack CLI choice, the analysis.msgpack artifact, the msgpack
  serialization mixin on schema models, and the msgpack dependency are gone.
  analysis.json is the single wire format; anyone passing --format msgpack
  must drop the flag. With one format left, the --format flag itself is now
  removed too — analysis.json is always written; anyone passing
  --format json must simply drop the flag.
• --emit neo4j now enforces its always-full-depth contract (Update Java model to comply with codeanalyzer v2.3.1 #119): it
  runs at level 4 with every graph section regardless of defaults, and
  explicitly passing -a/--graphs alongside it is now the documented
  explicit error (previously accepted silently — and worse, the emission
  actually ran at the default level 1, producing a partial graph). Passing
  --graphs below -a 3 is also now consistently rejected even when the
  value equals the default.
• numpy and pandas are no longer dependencies (Python-SDK does not handle import aliases #124): neither was ever
  imported by the analyzer, but both were declared in [project].dependencies
  with tight upper caps (numpy<1.24 below Python 3.11, numpy<2.0 above it).
  The caps forced resolution onto numpy releases with no prebuilt wheel for some
  targets — Red Hat UBI images in particular — so installation fell back to
  building numpy from source and failed. On Python 3.11+ numpy is now absent
  from the resolved tree entirely (ray 2.55 does not require it). On Python
  3.9/3.10 ray==2.0.0 still requires numpy transitively — that pin is
  untouched — but with the cap gone it resolves to numpy 2.0.2, which ships
  cp39 manylinux wheels for x86_64 and aarch64, so the source build stops
  happening there too.

Fixed