FIX7 Dependency Truth Analyzer Spec

PG catalog authoritative for identity/owner/ACL/native exposed edges/source; PG cannot prove full function-body callgraph. External deterministic analyzer in scripts/fix7/analyzer has sealed binary/version/feature/corpus/expected-result contract. Valid run requires exact roots/source set, native edges subset, no parse/unsupported/unresolved/unknown, <=24h and immediate invalidation on drift. Regex/source text diagnostic only. Dynamic SQL forbidden unless target OID/template/callsite are sealed and runtime membership checked. Unknown/stale/missing fails.