add FileDeps dataclass, .deps.json sidecar, and determinism test (PR-T1)

[HumanBean17]

Summary

• Adds FileDeps dataclass, _build_file_deps, _write_dependency_index, _read_dependency_index, and DepsIndex to build_ast_graph.py
• Every full rebuild now writes a .deps.json sidecar alongside the Kuzu database containing per-file dependency metadata for closure expansion in subsequent incremental runs
• 5 new tests in tests/test_incremental_equivalence.py: determinism, deps-json written/validated/coverage/stale/missing

Implements

PR-T1 of plans/active/PLAN-TIER2-INCREMENTAL-REBUILD.md

Manual evidence

.venv/bin/ruff check .
# All checks passed

.venv/bin/python -m pytest tests/test_incremental_equivalence.py -v
# 5 passed

.venv/bin/python -m pytest tests -v
# 625 passed, 9 skipped

Design notes

• .deps.json uses atomic write-temp-rename for safety
• ext_hash uses sha256: prefix matching proposal §2.4 format
• _read_dependency_index returns None on any corrupt/stale/missing file (broad except Exception after version validation)
• _write_dependency_index is called after conn.close() in write_kuzu — the sidecar doesn't need a DB connection
• test_perf_baseline_full_rebuild deferred (informational per plan)

🤖 Generated with Claude Code