feat: DI-aware forward tracing and get_static_dependencies tool for agentic enhancer

[joshbouncesecurity]

Context

Split from #39 per reviewer request — the agentic enhancer changes have a different risk profile from the parser changes and warrant a separate eval pass before merging.

Summary

• Adds get_static_dependencies tool to the agentic enhancer's tool set, so the exploration agent can retrieve statically-resolved callee and caller IDs and examine them with read_function
• Adds resolve_dependencies() to RepositoryIndex to map raw function IDs / qualified names back to function metadata
• Adds set_unit_context() to ToolExecutor so per-unit static dep data is available when the tool is called
• Updates the enhancer prompt to instruct the agent to trace forward into called functions (service/repository methods) and check for delegated authorization or validation before classifying a finding as EXPLOITABLE

Why independent of #39

The parser DI changes (#39) improve call graph edges regardless of how the LLM consumes them. This PR changes what the LLM does with those edges (and with the existing call graph for all languages). The classification impact — particularly the new "delegated security controls" branch — needs a before/after eval on a known dataset before hitting production.

Test plan

• test_enhancer_tools.py: resolve_dependencies, get_static_dependencies via ToolExecutor, context reset between units
• Before/after eval comparing verdict distributions on a representative scan corpus (EXPLOITABLE / VULNERABLE_INTERNAL / NEUTRAL / SECURITY_CONTROL rates)

🤖 Generated with Claude Code