docs(spec): Java config-read edges and the entrypoint report

[rahlk]

Design record for the epic in #62, covering codeanalyzer-java#231 goals 1 and 2.

Adds application.config_uses[], application.config_reads_unresolved[] and application.entrypoint_report{} to analysis.json, plus J_USES_CONFIG, J_READS_CONFIG_UNRESOLVED and two :JApplication properties to the Neo4j projection.

Two deliberate divergences from codeanalyzer-python, each recorded with its cost: src widens to the annotated element (Java's dominant config-read idiom is @Value, which has no call site to anchor on), and the literal tier runs at L1 rather than L2 (Java's call body nodes already carry the argument text).

#231's third goal is closed by fact rather than by work: codeanalyzer-python does not project comment nodes either — it collapses them to a docstring property, exactly as Java does — so there is no parity gap and no term to match.

The graph contract stays at 2.0.0; a re-baseline is #50's decision, and the spec records what that costs a consumer in the meantime.

[rahlk]

Pushed 487c056 — the spec now states the resolution rule and records what implementation settled.

One correction to my own earlier note: the "exactly one declared key" wording was never in this spec. It was in codeanalyzer-java#232's Goals checkbox, which I have also corrected. The spec's gap was different and worse — it never stated the resolution rule at all, so "exactly one" was a reasonable reading of the silence.

• D6 (new) — one J_USES_CONFIG edge per matching declared key; a read becomes undefined-key only on a zero-match. Follows python's resolver (config_use.py:304). A uniqueness rule would have dropped both real shapes: one key declared in application.properties and application-dev.properties, and D1's prefix binding claiming every key beneath it.
• D1 — the two shapes it left open, both settled during implementation: an unresolved annotation read ghosts the annotation type (@Value injection is a read, and the ghost names what performed it), and a @ConfigurationProperties prefix emits one edge per declared key beneath it.
• D3 — the one-line dataflow sketch replaced with the two tiers as built, plus the three refusals that make them safe. Most of all: why consulting only ssa prov is what keeps -a 3 ⊆ -a 4 true, since admitting an alias edge would remove an edge L3 resolved cleanly.
• D5a (new) — attribution lives on the node. L1Extractor reuses a cached module and skips the build, so a run-scoped tally would under-report frameworks_detected on a warm cache: exactly the ambiguous empty the report exists to prevent.
• D5 — unresolved/errors corrected to what the code does (a finder that throws), with the ceiling named: the finders swallow their own resolution failures internally, so those near-misses are not counted yet.
• §5/§7 — the decomposition table carries filed issue and PR numbers plus the branch stacking, and verification now says what the corpus runs can and cannot prove.