[lmeyerov]

Fix GFQL Cypher conversion operand validation

Fixes #2247

Change

• Adds one shared compile-time operand check for toInteger, toFloat, toBoolean, and toString.
• Rejects literal lists/maps, folded parameters containing those shapes, whole graph entities, and list-comprehension items actually consumed by a conversion.
• Resolves lexical comprehension bindings before classifying identifiers, so a bound comprehension variable shadows a same-name graph alias and nested variables use their nearest scope.
• Keeps data-dependent operands dynamic: malformed numeric strings still follow runtime conversion semantics, and ordinary property/column values are not rejected.

Evidence

• Exact head: 1bd503099aa602d9ff5fdcbf7b9c83b343a7216d; exact tree: e70d4c7785cc929644441e271100a3e83bd28c55; base: 9c2e88855619fffa25d330593f33888c79bc34d7.
• Local focused unary/const-fold tests: 1748 passed, 17 skipped across the combined non-cuDF selection.
• Exact-head DGX cuDF passes bounded static, lexical, and executable conversion probes. Exact-head Polars-GPU passes static/lexical validation and preserves its existing typed select runtime decline. Receipts: p0553-pr2250-gpu-cudf-2026-10-26.json and p0553-pr2250-gpu-polars-gpu-2026-10-26.json.
• Hosted gates for this exact head: CI 40254947379 SUCCESS, CodeQL 40254947365 SUCCESS, and RTD SUCCESS.
• ruff check, git diff --check, and the Cypher surface guard pass. No timing, comparison, release, deployment, or publication claim.