Entrypoints: framework-independent heuristic tier on the written decorator spelling

[rahlk]

Problem

Entrypoint detection is rule-driven (codeanalyzer/entrypoints/pipeline.py, matching.py): a decorator is first resolved to a qualified name (@http.route → odoo.http.route), then a frameworks: rule in rules.yml has to name that qualified name. Without an odoo block, the resolved name matches nothing and a project whose whole surface is @http.route reports zero entrypoints — the case #177 hit on Odoo. A decorator spelled @http.route, @app.get or @router.post is evidence of an entrypoint on its own, whether or not the analyzer knows the library behind it.

Two smaller defects seen in the same Odoo output: PyEntrypointReport.unresolved lists Python builtins (object ×20, Exception ×24, str, type) and subscripted generics (typing.Generic[T]) as unresolved bases, because base resolution consults only the import table; and the odoo.route rule defaults http_methods to [GET] while Odoo serves GET and POST unless methods= narrows the route.

Scope boundary

Decorators only, matched on the written spelling. No base-class heuristics and no routing engine — #27 keeps those. No schema change: PyEntrypoint.confidence already allows "heuristic".

Goals

• heuristics: block in rules.yml: heuristic.http-route ({route,*.route,*.*.route}) and heuristic.http-verb ({*,*.*}.{get,post,put,patch,delete,head,options,websocket}), confidence heuristic, disableable by id
• The tier runs on every node regardless of frameworks_detected; a node a framework rule already matched gets no heuristic record
• Route and methods extracted from the decorator arguments exactly as framework rules do
• * keeps its meaning inside a {a,b} alternation
• odoo.route default methods [GET, POST]
• unresolved skips builtins, subscripted generics, and any spelling whose head is an imported name or a declared class

Caveats and known risks

• A spelling heuristic flags non-HTTP .get/.post decorators (an event emitter's @bus.on is excluded, but @cache.get is not). That is what confidence: "heuristic" exists for; consumers threshold on it.
• Partly overlaps Framework-independent entrypoint detection (JackEE-style finders) #27 (framework-independent finders); this is the decorator half only.

Definition of done

• On odoo_slim with odoo.route and odoo.controller disabled via a user rules file, the heuristic tier alone finds the 534 @http.route methods.
• With default rules, 534 odoo.route records with [GET, POST] and zero heuristic records on those nodes.
• Unit tests for each goal; entrypoint, rules, decorator and light suites green.