fix(kotlin): resolve dependency graph through package declarations

[daBOB]

Problem

The Kotlin dependency graph assumes import data.Record lives in a file named data/Record.kt beneath a fixed source root. Valid Kotlin projects with flat source directories, multiple declarations per file, or same-package test references therefore lose real dependency edges. Kotlin package membership comes from the package header, not the directory or filename (language reference).

A minimal example is feature/ui/src/main/kotlin/Screen.kt importing data.Record, declared in core/data/src/main/kotlin/Records.kt. The old builder emits no edge. Discovering more module roots alone, as in #739, cannot resolve this layout.

On a real Android project, the same 238 discovered Kotlin/KTS files produced zero edges even with #781's path normalization. This patch produces 455 edges, including 196 edges from test sources. Concrete recovered relationships include WatchStateRepositoryTest.kt → WatchStateRepository.kt and CatalogViewModelTest.kt → CatalogViewModel.kt. No application sources, discovery exclusions, zones, scores or scanner state were changed for this comparison.

Change

Build a scan-local package/declaration index from the already discovered parsed files. Explicit imports resolve classes, top-level functions/properties, aliases, operator functions and members owned by an outer type. Graph keys retain the discovered path spelling; unscanned files cannot become candidates.

Same-package and star-import inference is deliberately limited to unique type declarations referenced through bare type uses or constructor-shaped calls. Local declarations, type parameters and explicit imports/aliases suppress inferred matches. Private declarations and ambiguous owners are not credited across files. Star imports do not connect every file in a package.

This is not compiler resolution: implicit extension/property/function usage, overload selection, fully qualified references, inherited binding resolution and Gradle source-set visibility remain outside this patch. Conservative whole-file shadow suppression can omit valid edges. It does not claim every remaining orphan/test-gap finding is real, or that graph connectivity proves behavioral test coverage.

Validation

• 15 real tree-sitter parser regressions pass. Five initial positive cases fail on the prior implementation. A further ambiguous-star fallback regression was demonstrated failing before tightening that case.
• Independent source review passed.
• Integrated with fix(kotlin): retain implicit imports and validate autofix advice #777, fix(kotlin): parse ktlint reports and scope formatting to eligible files #778 and fix: preserve dependency edges for relative tree-sitter file paths #781 in a temporary checkout: 6900 passed, 23 skipped, 2 failed across the upstream suite. Both failures are the existing duplicated test_do_run_batches_dry_run_generates_packet_and_prompts prompt-contract cases; both reproduce on pristine base 3a7735d.
• Ruff and whitespace checks pass.
• Real CLI scan and next completed on an isolated copy of the same 238 authored Android files and configuration: 136 production / 88 test / 14 config. The scan exercised graph and test mapping registration. ktlint was unavailable in that isolated CLI invocation, so this is graph integration evidence, not a complete lint assessment.
• Installed CLI and original project state remain unchanged. Only this focused patch is included here; the other PRs were combined solely for verification.