#3265 step 1: repository-wide call resolver (callee name -> definition, with confidence) #3328

Part of #3265. Depends on #3327 (contract). This is the core of the feature. A function-level graph built on bare names pools every save()/get()/run() together, so function PageRank would rank the most common names, not the most depended-on functions. Linking each call to the right definition matters more than anything else in #3265.

Generalize gitgalaxy/core/invocation_resolver.py (today COBOL/JCL only: PROGRAM-ID first, nearest on a tie) into a resolver for every language. For each (caller function, callee name), stop at the first match:

1. Same class, then same file.
2. Files the caller's file imports (the resolved import graph from network_risk_sensor.py). Uses the qualifier from #3265 step 2: capture the call qualifier (utils.parse, obj.save, Class::method) #3329 once available.
3. A name defined exactly once in the repo.
4. Nearest by path among several candidates (core/path_proximity.py).
5. Not defined anywhere in the repo -> external (stdlib / third party). Not an edge. This removes most built-in noise without per-language ignore lists.
6. Still more than one candidate -> ambiguous. Either split the weight 1/k across the candidates or leave it out -- decide here and record why.

Output: edge_data rows with a new edge_kind (e.g. 'fcall') and a confidence tag (unique / scoped / ambiguous), function-to-function, plus the file pair. As with #3200, these edges do not enter the dependency DiGraph -- no existing column may change (the edge_kind = 'import' reconciliation invariant from #2992 must stay intact).

Done when: rows are emitted for the full corpus, existing golden-master columns are unchanged, and the per-step match counts are logged (they feed #3331's resolution rates).