refactor(graph): use Kuzu 0.11 native features (FTS, param LIMIT, []string)

[aksOps]

Summary

Kuzu 0.11.3 (merged in #155) lifts several restrictions that 0.7.1 had. This PR unwinds the workarounds we coded against the older runtime and exposes the native capabilities — most notably real FTS with BM25 ranking instead of CONTAINS predicates.

What changed

FTS (fulltext search) — `internal/graph/indexes.go`

• `CreateIndexes()` was a no-op (Kuzu 0.7.1 needed a network `INSTALL fts` — incompatible with air-gapped builds). 0.11.3 ships FTS bundled.
• Now creates two FTS indexes after enrich:
  • `code_node_label_fts` over `(label, fqn_lower)`
  • `code_node_lexical_fts` over `(prop_lex_comment, prop_lex_config_keys)`
• `SearchByLabel` / `SearchLexical` use `CALL QUERY_FTS_INDEX` with BM25 ranking. Auto-appends `*` for prefix match on bare single-token queries (preserves the old "AuthService matches 'auth'" UX).
• CONTAINS-based fallbacks retained for graphs without enrich (pre-index state).
• Mutation gate (`MutationKeyword`): `CALL QUERY_FTS_INDEX` is allow-listed (read-only); `CREATE_FTS_INDEX` / `DROP_FTS_INDEX` stay blocked under `OpenReadOnly`.

Parameterized LIMIT / SKIP

Kuzu 0.11.3 accepts `LIMIT $param` and `SKIP $param` as bound parameters; 0.7.1 required inline literals. Cleaned up at:

• `internal/graph/indexes.go` — SearchByLabel / SearchLexical
• `internal/graph/reads.go` — FindByKindPaginated
• `internal/query/service.go` — FindCycles, FindDeadCode
• `internal/mcp/tools_graph.go` — list-edges, ego-neighbours, endpoints-by-id
• Helper `intLiteral` removed (only used to format inline LIMITs).

Drop `stringsToAny` widener

Kuzu 0.7's Go binding required `[]any` for list parameters; 0.11.3 accepts `[]string` directly. The widener helper is gone; `query.FindDeadCode` and `topology.FindServicesContainingNodes` pass `[]string` straight.

Still present in 0.11.3 (workarounds retained)

• List comprehension binder still rejects out-of-scope vars — keep `properties(nodes(p), 'id')`
• `EXISTS { … }` subquery still doesn't see outer-scope `$param` — keep rel-pattern alternation
• Recursive pattern upper bound `[*1..N]` still requires a literal
• BlastRadius's anonymous-recursive pattern stays

CLAUDE.md

Rewrote the Kuzu quirks section as "lifted in 0.11.3" vs "still present" buckets so future contributors don't reintroduce workarounds that the runtime no longer needs.

Test plan

• `cd go && CGO_ENABLED=1 go test ./... -count=1` — 883 passed
• End-to-end on `polyglot-bench/airflow`: enrich exit 0, 95k nodes / 246k edges, FTS search returns BM25-ranked hits
• End-to-end on `~/projects/`: enrich exit 0, 187k nodes / 414k edges / 1m 29s / 1.88 GiB peak RSS (slight perf improvement vs pre-refactor)
• `CALL QUERY_FTS_INDEX('CodeNode', 'code_node_label_fts', 'service*') ... ORDER BY score DESC LIMIT 5` returns ranked results (scores 12–14 across method/class kinds)

Out of scope

• Removing the lower-cased `label_lower` / `fqn_lower` columns from the schema — they still back the CONTAINS fallback path. Migrating fully off them is a separate, riskier schema change.
• Tokenizer tuning (camelCase splitting, stem) — defaults work well for the codebase patterns observed.

🤖 Generated with Claude Code