bump codeanalyzer-python pin to 1.5.3

[rahlk]

Is your feature request related to a problem? Please describe.

pyproject.toml hard-pins the Python analyzer:

dependencies = [ ..., "codeanalyzer-python==1.5.2", ... ]

[tool.backend-versions]
codeanalyzer-python = "1.5.2"

codeanalyzer-python v1.5.3 shipped on 2026-09-14 with two fixes (codellm-devkit/codeanalyzer-python#216, #217). Neither reaches an SDK user until this pin moves: an analyzer release and a consumable analyzer release are two different claims, and the pin is the gate between them.

• The analyzer no longer ingests its own output (codeanalyzer-python#207). discover_artifacts walked the project with no idea where the run writes, so an output or cache directory inside the input made run N inventory run N-1's analysis.json and embed it whole. The SDK's default cache_dir is <project>/.codeanalyzer, inside the input, so every local SDK run was exposed.
• One body node per call site, even when two calls share a start position (codeanalyzer-python#215). body was keyed on the call site's start position; in getattr(o, n)(x) the outer application and the inner getattr share it, so the dynamic invocation was dropped from the payload, the L3/L4 graphs and the Neo4j projection. A key now carries a /2, /3 disambiguator, outermost first. On the flask fixture this recovers 68 call nodes.

Describe the solution you'd like

• dependencies pin → codeanalyzer-python==1.5.3.
• [tool.backend-versions] table → 1.5.3 (both must move together; they are read independently).
• uv.lock regenerated.
• Python test tier green with 1.5.3 actually installed.

Describe alternatives you've considered

Not stated in the original issue.

Additional context

Scope boundary

• Pin bump only, in both places the version appears. No facade change, no new accessor.
• Neither fix moved the schema contract: payload schema_version and graph SCHEMA_VERSION both stay 2.0.0. PyNeo4jBackend._ANALYZER_FLOOR stays (1, 5, 0); nothing on the read path needs 1.5.3 to answer.
• codeanalyzer-python#219 (http_methods carries HTTP methods only) is merged on main but not in 1.5.3. It is not part of this bump.
• Incorporate codeanalyzer-python v1.5.2 #396 (the 1.5.2 read-path uptake) stays open and separate.

Caveats and known risks

• 1.5.3's changelog states python-sdk needs no change for the suffixed body key because body_key_column already parses it. Verify, do not assume: cldk/analysis/commons/keys.py is the parser.
• A body key that used to collide now resolves to the outer call. A call whose callee is itself a call now carries callee_signature: null and method_name: "<unknown>" instead of being labelled a call to the inner callee. Any SDK test asserting an exact call-site count or an exact callee signature on such a site will move, and that movement is correct; check before treating it as a regression.
• The own-output fix can change artifact inventories for a project that already holds a stale .codeanalyzer/analysis.json from an earlier run: those entries disappear from get_artifacts()-style results. That is the fix working.

Definition of done

Both pins read 1.5.3, uv.lock matches, the mocked and local-analyzer Python tiers are green with the 1.5.3 wheel installed, and any fixture expectation that changed is updated with a comment naming the analyzer release that changed it.

[rahlk]

Merged in #411 (d2ac15d) on release/2.0: both pins read codeanalyzer-python==1.5.3, uv.lock regenerated, Python tier 482 passed / 168 skipped on 1.5.2 and 1.5.3 alike. Ships with 2.0.0-rc.8.