python-sdk: Rust slicer replaces cldk.graph L3/L4 engine (differential-gated port + deprecation)

[rahlk]

PROBLEM

After M1, python-sdk has two dataflow engines: the Python L3/L4 slice engine (cldk.graph, #270/#271) and the Rust query core's traversal machinery. Two engines with subtly different semantics can produce contradictory audit evidence. Decision locked: the Rust core replaces the Python slicer.

SCOPE BOUNDARY

No schema change; the slicer consumes the same L3/L4 CFG/CDG/DDG substrate. The public cldk.graph API surface is deprecated, not removed, in this issue — removal happens in a later major. No new analysis capability: this is a semantics-preserving port with a deprecation.

GOALS (the contract, as a checklist)

1. Forward/backward slicing implemented in cldk-query-core over the serde CPG substrate, exposed through PathQuery-family plan nodes.
2. The existing cldk.graph exact-set gates (the F7: L3/L4 consumption API — shared program-slice engine + five facade verbs (slice/flows/def-use) #270/feat(graph): L3/L4 program-slice engine core (Tasks 1–6 of #270) #271 fixture suites) ported as cargo tests and green against the Rust slicer.
3. Differential gate: Rust slicer output equals the Python engine's on every existing fixture (exact node sets, not counts).
4. cldk.graph's Python engine marked deprecated (warning on import), delegating to the Rust core.
5. Confidence/provenance semantics (prov tiers, degrade labels) preserved per the 07-09 spec's D6/D7.

CAVEATS AND KNOWN RISKS

• Semantic drift is the whole risk — the differential gate is the deliverable; any intentional divergence must be documented as a fixture change, never silently absorbed.
• k-limiting / termination behavior must match the Python engine's documented posture.

DEFINITION OF DONE

• Differential gate green on all existing L3/L4 fixtures (exact sets).
• Deprecation warning in place; docs note the migration.
• No remaining code path where a user query mixes both engines' results.

Part of #279