feat(dataflow): stage 3 — access paths, reaching definitions, DDG

k-limited access-path model with per-scope base classification (local/
param/self/global/capture), header-only facts for compound statements,
comprehension scoping, closure-capture and call-mutation rules; classic
worklist reaching definitions with strong kills on exact non-wildcard
paths; DDG edges via textual interference plus the type-based may-alias
oracle (the locked MVP points-to substrate — unknown types conservatively
alias, incompatible types don't). Gate tests cover the loop-carried
dependency, scope shadowing, and the aliased write/read pair. (#67)

Author: rahlk