add incremental rebuild orchestrator (PR-T3)

Implements build_ast_graph_incremental() which re-processes only changed
files and their dependency closure, falling back to full rebuild when
deps.json is missing, ontology is stale, or dirty set exceeds 50%.

Key additions:
- expand_to_closure: 8-rule fixed-point expansion using inverted .deps.json
- pass1-5 subset variants for partial re-processing
- _load_remaining_from_db + _merge_tables for pass6 global rerun
- _write_nodes_incremental with duplicate-PK avoidance
- _write_meta_incremental querying live DB for global stats
- --changed-paths CLI flag and last_rebuild_mode GraphMeta field
- 22 tests: equivalence, fallback, closure, deps merge, pass6 invariant, meta stats, CLI

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: HumanBean17