python-sdk: slice/taint/reachability queries over the v2 SDG

[sinha108]

Plan (optional)

Design spec: https://github.com/codellm-devkit/codeanalyzer-java/blob/main/docs/design/specs/schema-v2-l3-l4-design.md

Problem

The analyzer is a pure graph provider: it emits the v2 SDG (cdg/ddg/param_in/param_out/summary) and stops. The client analyses that consume it — backward/forward slicing, taint, and reachability — live in the SDK and do not exist yet for the v2 graph. This issue adds them.

Scope boundary

SDK query layer only, over the analyzer's emitted v2 SDG — no analyzer changes (no taint_flows section, no sources/sinks policy in the analyzer). Depends on the SDK v2 models (the model-migration issue) landing first, and on the analyzer's L4 summary edges for context-sensitivity.

Goals

• Backward/forward slicing as reverse/forward reachability over cdg ∪ ddg ∪ param_in ∪ param_out ∪ summary (two-phase HRB up-then-down traversal)
• Taint as a policy-keyed reachability query (sources/sinks/sanitizers supplied at query time, not baked into the graph)
• Reachability queries (flows_to_statement(...), reachable_by(...)) exposed on the SDK facade
• Line-level addressing via …@line:col node ids

Caveats and known risks

• Taint results are keyed on a policy that evolves at SDK speed — kept out of the analyzer deliberately (it is not a graph fact).
• Query precision/context-sensitivity depends on the summary edges (analyzer L4 summary-pass issue).

Definition of done

• Slice gate: a named backward slice over the fixture equals the hand-computed node set exactly.
• Taint gate: a source→sink flow is detected on the fixture, and a sanitizer on the path breaks it.
• Frontend query gates green (mocked + E2E over the v2 SDG).