fix: fail closed on eager callable definitions

[shaggitza]

Summary

Closes #275.

This final secure-AST tranche handles eager nested definitions inside already-authorized factory and bootstrap callable slices without executing project code.

• adds one private bounded eager-definition analyzer shared by factory and bootstrap interpretation;
• evaluates the CPython eager boundary for nested function/async-function decorators, defaults, keyword defaults, and active annotations while leaving deferred bodies and postponed annotations untouched;
• handles nested class headers, isolated class bindings, lexical global/nonlocal effects, nested class bodies, and class-local shadowing conservatively;
• preserves exact supported nested route decorators and fails closed on unsupported class-body registration, arbitrary decorators/metaclasses/descriptors, protocol-dispatch expressions, control-flow definitions, imported/re-exported walrus rebinding, and object escape;
• records bootstrap uncertainty in synthetic operation order so router copy cutoffs remain truthful;
• validates decorator metadata/path shapes consumed by FastAPI before emitting established routes;
• keeps PEP 695 bounds lazy while modeling type-parameter shadowing on Python 3.12;
• adds private work/depth limits and converts actual parser complexity MemoryError to source-backed unavailable evidence.

Unsupported eager effects never leave stale endpoints or established-empty inventory. Destructive or escape uncertainty conditions affected endpoints; receiver-only additive uncertainty is narrowed only after exact validated registration and safe remaining headers.

Scope

Only native secure-AST extraction and focused tests change. No public schema/configuration, custom-surface, runtime extractor, benchmark, or static-value budget changes.

Validation

• 543 secure-AST tests passed locally on Python 3.12; the full file also passed on Python 3.11 with only Python-3.12-specific PEP 695 skips.
• All 69 resource-isolated repository test files passed locally, excluding only the known platform-specific tests/benchmarks/test_pilot_typed_run_v3.py broker path.
• Ruff format/check passed for all src and tests files.
• strict mypy passed all 41 source files.
• package source and wheel builds passed.
• multiple adversarial review/fix rounds covered protocol dispatch, descriptor access, class/global binding, imported aliases, copy ordering, metadata application, parser resources, and no-execution sentinels.
• terminal path verification returned PASS.

Conservative behavior

Opaque decorators, models/callables, nonliteral decorator paths, and unsupported metadata are intentionally conditional/unavailable rather than guessed. Exact class-body route registration remains source-backed conditional evidence instead of being modeled as established.