P0: Add bounded callable points-to and conservative virtual dispatch

[shaggitza]

Priority

P0 — major propagation-recall and dispatch-soundness gap.

Problem

The finite points-to domain models selected object/framework cases but not general callable values; meanwhile nominal/protocol receiver types can be promoted to false EXACT dispatch.

Evidence:

• src/fastapi_endpoint_detector/analyzer/mypy_analyzer.py:1759-1824,2080-2421,2680-3230
• src/fastapi_endpoint_detector/models/effect_contract.py:445-513

Reproduced failures:

• callback = changed; callback() missed changed.
• invoke(changed) reached invoke but not its callable parameter.
• Bound-method aliases, callable factory returns, functools.partial, Depends(Provider()), and partial dependencies were missed.
• value: Protocol; value.run() and value: Base = Child(); value.run() selected the declaration on the protocol/base as exact instead of the runtime override.
• Overload calls traversed the signature stub rather than OverloadedFuncDef.impl.
• Function-local static imports and consumed generator expressions were missed.
• An unrelated ordinary call could globally clear otherwise useful finite state.

Required design

Introduce a bounded callable abstract value containing:

• exact function/method declaration;
• optional bound receiver;
• bound positional/keyword arguments;
• finite union with existing target caps;
• qualified provenance and confidence.

Propagate through assignment, branches, project function parameters/returns, __call__, and exact functools.partial. Preserve unrelated immutable/exact locals with selective kills. Reserve EXACT virtual dispatch for source-proven exact receivers, super(), final classes, or final methods; open classes/protocols/ABCs must be ambiguous/LOW unless a finite concrete set is proven.

Acceptance criteria

• Exact aliases, bound methods, forwarding chains, callback returns, callable objects, and exact partials resolve.
• Finite unions, target overflow, mutation, escaping closures, and *args/**kwargs fail closed with limitations.
• Protocol/open-base calls cannot match exact effect contracts without concrete receiver evidence.
• Overloads traverse implementation nodes while keeping canonical identity.
• Lexical imports honor shadowing and branch joins.
• Exact eager generator consumers execute deferred generator-expression bodies.

Related: #107.