feat(core): harden graph edge extraction (dotted Python imports, Ruby strings)

[rutvikchandla3]

Summary

Three scoped hardening follow-ups to the relational code-graph edge extractor
(packages/core/src/repo.ts), all label-honest: edges stay import-resolved or
name-only — never type-resolved (there is no type checker).

1. Dotted Python imports

import a.b.c now binds the full dotted module path instead of only the
top-level segment. So a.b.c.func() resolves to func in a/b/c.py
(import-resolved when the module exists on disk, name-only otherwise) and no
longer emits bogus intermediate b/c edges. Single-segment import os and
import x as y are unchanged. Dotted from a.b.c import func continues to
resolve to the dotted module file.

2. Ruby string masking

maskRubySyntaxLines now blanks:

• =begin / =end block comments
• heredoc bodies and terminators — conservative opener forms <<~, <<-,
  quoted tags (<<'EOS', <<"HTML"), and plain <<IDENT only for
  uppercase-led tags (so array << item left-shift is not misread as a
  heredoc)
• single-line %w / %i / %W / %I word arrays

The opener line keeps any real code before the <<… token. Identifiers buried
inside these constructs no longer leak out as bogus name-only call edges.

3. Name-only test coverage

Added persisted-edge + findCallers tests for Java, Ruby, and Rust
(previously only Go and Python were covered), plus dotted-import and
Ruby-masking regression tests. The Ruby test asserts that ghost_call/select/
notify buried in a block comment, a heredoc, and a %W[] literal produce
zero edges while the real call still resolves.

Verification

Run on Node 22 (pnpm build, pnpm typecheck, pnpm test):

Test Files  11 passed (11)
     Tests  184 passed (184)

(was 177 before this change — +7 tests, no regressions.)

🤖 Generated with Claude Code