fix(python): locate places a decorator-line position on the decorated callable

[rahlk]

Closes #408. Stacked on #411 (the 1.5.3 bump) so the two CHANGELOG.md entries share one rc.8 section; retarget to release/2.0 once #411 merges.

PyCallable.start_line is the def line (ast.FunctionDef.lineno) and the AST puts decorators above it, so a position on @http.route(...) sat inside no callable span and locate reported module_scope. Both backends now read where the decorator is applied:

• local: _find_innermost admits the callable whose decorators[].span starts at or before the line and above its def (_decorator_covers);
• Neo4j: _LOCATE_QUERY gains one EXISTS disjunct over PY_DECORATED_BY.start_line, which codeanalyzer-python 1.5.2 emits.

Ranking is unchanged (def-based width), so a decorator on a nested callable resolves to the nested one. Not changed, and pinned by tests: a blank line with no decorator over it stays module_scope (no nearest-callable fallback); a class decorator stays module_scope; an analysis or graph from 1.5.1 or earlier, which records no decorator span, answers exactly as before and raises nothing.

Tests. The shared locate fixture gains cached (two decorators), outer.helper (decorator on a nested callable inside the enclosing span), old (decorator recorded without a span) and a @dataclass class. Fourteen new tests over both backends, parity included; the fake driver's responder evaluates the disjunct only when the statement names PY_DECORATED_BY and only over edges that carry start_line, so dropping either fails the suite.

Measured. odoo-slim-19 re-emitted by codeanalyzer-python 1.5.3 at level 1 (1,626 modules, 15,549 callables, 5,615 decorator edges), 40 positions (20 decorator lines, 20 body lines), median of 5, same graph both ways:

statement	time	placed	decorator lines placed
old	71.0 ms	20/40	0/20
new	70.2 ms	40/40	20/20

The plan still seeks pysymbol_id (NodeUniqueIndexSeekByRange); the disjunct runs as SelectOrSemiApply over the seek's rows. The number is recorded above _LOCATE_QUERY.

Verification. tests/analysis/python offline: 496 passed, 168 skipped (all live-Neo4j tiers). Rest of the offline suite: 1298 passed, 236 skipped. docs/agent-api-reference.md gains a decorator-line row in the locate outcomes table.

Siblings checked. TypeScript's callable span starts at the first decorator line (measured with 1.6.0: start_line 4 for a method declared on line 6) and Java's at the first annotation line (measured with 3.3.3: span start [4, 5] for a method declared on line 6), so neither backend has this gap.

[rahlk]

Live tier on the 1.5.3 graph (cldk-408-it, bolt 7698, odoo-slim-19 re-emitted at level 1): test_e2e_neo4j_live.py, test_bounded_enumeration.py, test_resolve.py, test_neo4j_self_loops.py.

branch	result
release/2.0 (same graph, via a worktree)	8 failed, 100 passed, 17 skipped
this branch	8 failed, 100 passed, 17 skipped, identical failure set

Every locate live test passes on both. The eight failures pre-exist and are about the graph, not this change:

• six are the level-1 emit: no PY_RESOLVES_TO, no formal_in ports, so resolve_value raises SelectorNotInGraph and the resolution-edge probes find nothing;
• test_locate_parity_documented_module_source_divergence's live twin pins the stale module_source_unavailable divergence that Incorporate codeanalyzer-python v1.5.2 #396 tracks — :PyModule.source is present on this graph (1,626 of 1,626);
• test_get_config_keys_and_config_uses_line_up: get_config_uses() came back empty on a graph that carries PY_USES_CONFIG edges. Not touched here; worth its own look.