feat(prover): delivery D: control flow decides dominance; the trace carries each guard's relation, effect and the operation's control context

Opus agent delivery under spec access-control-prover, requirement 10. `semantic/cfg.py` builds a control-flow
graph per function from the syntax tree (if/else, switch arms, loops, try/catch/finally, return, throw, break,
continue, exit, assert) with dominators and a per-line control context, and leaves a function without a graph
rather than a wrong one. `obligations/cfg_dominance.py::CfgDominance` discharges a statement guard only when it
lies on every path to the operation and the operation is unreachable from its failing arm; a predicate whose
result nothing consumes is `value_only` and never discharges; router, decorator and earlier-hop witnesses behave
as before; without a graph the order rule applies and `cfg_unavailable` is recorded. The trace's guards carry
`relation` and `effect`, the trace carries `operation_context`; Java parameter lists carry names only; a
handler-named operation's arguments are the handler's parameters. The checker's default stays order-based.

Smoke on the 23 fix changes: 15 caught, 55 of 93 locations, precision 15 of 15, no failure, no change over
120 s (unchanged from delivery B). Gate: 3575 tests pass; the reserved-repository guard passes on the export.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

.kiro/specs/access-control-prover/design.md

@@ -233,7 +233,11 @@ exit consumes before the operation is `value_only` and never discharges; router
 dominate as before; along a path record, a witness on an earlier hop dominates as before. Without a graph for
 a function, `CfgDominance` falls back to `OrderDominance` and records `cfg_unavailable`.
 The trace's `Guard` gains `relation` (`all_paths`, `some_paths`, `none`, `after`) and `effect`
-(`throws`, `returns`, `exits`, `value_only`); the trace gains `operation_context: ControlContext`.
+(`throws`, `returns`, `exits`, `branches`, `value_only`; `constrains` for an identity constraint or a
+non-permissive value on the operation's own line, which has no failing arm; router and decorator witnesses carry
+`exits`); the trace gains `operation_context: ControlContext`. Coarse spots accepted for this increment: a
+ternary or switch expression is one node, several statements on one line share it, a guard's result held in a
+variable is followed by name without reassignment tracking.
 
 ### obligations.enforcement
 ```python

.kiro/specs/access-control-prover/tasks.md

@@ -80,7 +80,7 @@
   - _Requirements: 9.1, 9.2, 9.5, 9.6_
   - _Depends: 4.2_
 
-- [ ] 4.4 `semantic/cfg.py`: structural control-flow graph per function from the syntax tree, dominators, control context (P)
+- [x] 4.4 `semantic/cfg.py`: structural control-flow graph per function from the syntax tree, dominators, control context (P)
   - Java, PHP, Python, JavaScript and TypeScript constructs of requirement 10.1; `cfg_unavailable` otherwise
   - Done when `tests/test_semantic_cfg.py` shows, per language, that a guard before an unconditional return
     dominates, a guard inside an if-branch does not dominate a statement after the branch, a guard inside a
@@ -88,7 +88,7 @@
     conditions and loops
   - _Requirements: 10.1, 10.2, 10.4_
   - _Boundary: semantic.cfg_
-- [ ] 4.5 `obligations/cfg_dominance.py::CfgDominance`, failure effects, and the trace's control components; the prover selects it; Java parameter names and handler-operation arguments cleaned
+- [x] 4.5 `obligations/cfg_dominance.py::CfgDominance`, failure effects, and the trace's control components; the prover selects it; Java parameter names and handler-operation arguments cleaned
   - Done when `tests/test_obligation_cfg_dominance.py` shows a value-only predicate does not discharge while the
     same predicate guarding a throw does; a branch-only guard yields `some_paths` and no discharge; the prover
     smoke on the 23 fixes keeps or raises its recall; `tests/test_mapping_frameworks.py` shows Java parameter