Analyzers record their schemas in `codeanalyzer-schema` on release

[rahlk]

Spec: docs/design/specs/2026-09-09-schema-uptake-on-release.md

Summary

Each codeanalyzer-<lang> release workflow gains a final step that records what that release emits into codellm-devkit/codeanalyzer-schema as a pull request: the Neo4j graph contract to v<major>/neo4j/<lang>/, and the analysis.json samples to v<major>/json/<lang>/. Both destinations are derived from the schema_version inside the emitted documents, so nothing is hard-coded to v2 even though every analyzer reads 2.0.0 today. No schema impact: no analyzer changes what it emits, this only records it.

Why

The contract repo refreshes its samples by hand, which means late. On 2026-09-09 its tracked copies were three releases behind across the board — python 1.4.0 against a released 1.5.0, java 3.0.1 against 3.1.1, typescript 1.2.0 against 1.5.2 — and the python Neo4j contract still declared a _module property that 1.4.1 removed. Nothing was broken in any analyzer; the record of what they emit had drifted, and only a manual regeneration could show it. That failure is silent by construction.

Affected repos

• codeanalyzer-python — adds the step to its release workflow
• codeanalyzer-java — adds the step to its release workflow
• codeanalyzer-typescript — adds the step to its release workflow
• codeanalyzer-schema — receives the PRs; no change of its own

Design decisions

• A pull request per release, not a push: three analyzers on their own clocks would race, and a contract change should not land unreviewed. A re-run of a tag force-updates its own branch instead of opening a second PR.
• The destination line is derived from each emitted document's own schema_version, and the two projections are read independently because their versions are independent lines.
• Samples as well as the contract — the JSON half is the half that was three releases stale.
• Token: ORG_DISCUSSIONS_TOKEN, the org PAT these workflows already use cross-repo. It needs contents:write and pull-requests:write on the contract repo; the step fails with an explicit message naming CLDK_AUTH_TOKEN as the documented repo-scope alternative if it 403s.
• Scope guard: analysis.schema.json is never touched — it is hand-written, not analyzer output.

Release plan

No lockstep. Each analyzer's step takes effect at that analyzer's next release, independently. The step is inert until a tag is pushed.

Definition of done (epic-level)

• Every sub-issue closed and all three release workflows carry the step, gated on a tag, as the last step of the release job.
• A release on any one analyzer opens a PR on codeanalyzer-schema containing only that analyzer's files, at paths matching the existing layout.
• The token carries the scope the step needs, or the failure names the alternative.