Incorporate codeanalyzer-python v1.4.0

[rahlk]

A new codeanalyzer-python release (v1.4.0) is published.
Update the codeanalyzer-python pin in this repo and adapt the
integration to the changes below (see PyCodeanalyzer._run_analyzer).

[1.4.0] - 2026-09-02

Removed

• BREAKING: the artifact-text byte cap, its --artifact-text-max-bytes
  flag, and the PyArtifact.text_truncated field (also the Neo4j :Artifact
  property). An artifact's source is now the whole file, or "" because it
  is binary or --no-artifact-text was passed -- never a prefix. A truncated
  source read exactly like a complete small file, and the flag meant to
  distinguish them conflated "whole file" with "capture off"; measured on
  microsoft/vscode the cap fired on 32 of 4,953 artifacts (0.6%). Matches
  codeanalyzer-typescript, which removed both in its Update get_all_docstrings to return dict #117. --no-artifact-text
  is unchanged. python's dependency-manifest exemption from the cap is gone
  with the cap -- every decodable file is captured in full (Reachability API: reverse reachability (given a sink, find all sources that reach it) #172).

Fixed

• Neo4j incremental push no longer deletes a sibling analyzer's nodes. The
  per-module purge matched MATCH (x {_module: $m}) with no label, and
  _module is a shared convention -- codeanalyzer-java and
  codeanalyzer-typescript set it on their nodes too -- so where a file key
  collided, a python push silently detach-deleted their graph. Both statements
  are now anchored on the python-owned labels, derived from the schema catalog
  (MODULE_OWNED_LABELS) so a new module-scoped label is covered
  automatically (Reachability API: forward reachability (given a source, find all reachable sinks) #171).

Changed

• A Neo4j Bolt push no longer deletes anything by default. The per-module purge
  and the full-run orphan prune are the only destructive steps, and both now run
  under --eager only; a default --lazy push is purely additive. The cost of
  the default is staleness -- a declaration or call edge the source no longer has
  survives until an --eager push reconciles it -- and the gain is that an
  incremental push into a shared database cannot destroy anything (Reachability API: forward reachability (given a source, find all reachable sinks) #171).

Added

• An _module index per module-owned Neo4j label. The per-module purge ran as
  an unindexed scan once per changed module -- quadratic on a full push (Reachability API: forward reachability (given a source, find all reachable sinks) #171).