fix(bindings): declare no Rust test targets for pyo3/napi FFI shims

The pyo3/napi cdylib crates leave their extension symbols undefined for
resolution at import/dlopen time, so an ordinary cargo test executable
can't link against them. Set test = false / doctest = false on both
binding crates and drop their now-dead #[cfg(test)] modules, since
coverage already comes from the real FFI boundary (query.test.cjs,
test_query.py). Update the CI comment to match.

fix(bindings/node): bump js-yaml to 4.3.0 for GHSA merge-key DoS

js-yaml < 4.3.0 lets chained YAML merge keys force quadratic CPU
consumption. It reaches the tree as a dev-only transitive of
@napi-rs/cli, so the lockfile is the only place to pin it.

Regenerating the lockfile also syncs the root name with the scoped
@nodedb-lab/code2graph package name already set in package.json.

test(bindings/pi): expect extractWithBindings in native adapter guard

Update the completeness check and its error-message regex to include
the extractWithBindings method now required on the native adapter.

feat(extract): descend module-level control flow for Python symbols

Constants and functions guarded by module-level if/try/with/for/while
blocks (optional-import fallbacks, platform-conditional constants) were
previously invisible to the extractor since it only walked direct
children of the module root. Recurse through control-flow containers
while still stopping at function/class bodies, so conditionally-defined
globals are captured without local bindings leaking as module symbols.

fix(release): nonpublishing napi packaging and exact platform tarballs

fix(cli,resolve,package): resolve rustdoc warnings and make Windows W…

…AL test deterministic

deps(cli): bump zerompk to 0.6 and refresh lock

fix(node): commit generated loader so the npm package is usable

The published main package shipped without index.js/index.d.ts: they were gitignored and the publish job never re-runs `napi build`, so the package had no entrypoint and could not be imported. Commit the generated JS interface (regenerated for the scoped @nodedb-lab/code2graph name) and ignore only the per-platform *.node binaries. Verified: the package loads via the published platform binary and resolves a cross-file call edge.