docs(cpg): name the upstream issue for joern-parse --overlaysonly (joernio/joern#6283)

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

.kiro/specs/contributor-scan/tasks.md

@@ -892,7 +892,7 @@
 
     Three changes, each named in the log rather than silent: (1) `queries/overlay.sc` runs `importCpg` +
     `save` once at build time and the saved graph replaces the raw one (`joern-parse --overlaysonly` is the
-    obvious tool and NPEs in 4.0.623); (2) a source file over `MAX_SOURCE_BYTES` (1 MB) is excluded from
+    obvious tool and NPEs in 4.0.623 -- filed as joernio/joern#6283); (2) a source file over `MAX_SOURCE_BYTES` (1 MB) is excluded from
     the build as a data table and reported in `unparsed`; (3) the hook half's seeds are the callback's own
     file. The payload diff between a raw and a saved-overlay pmpro graph was checked request by request:
     identical (sink, line, source kind, sanitized) sets, fewer repeated flow paths on the saved one.

src/openultrasast/cpg/backend.py

@@ -616,7 +616,7 @@ class JoernBackend:
         CVE-2022-25148 on, one hour before the switch, from a `joern-parse` build. Task 5.13.
 
         `queries/overlay.sc` is that once: `importCpg`, `save`, and the saved graph replaces the raw one
-        under the same path. (`joern-parse --overlaysonly` is the obvious tool and is broken in 4.0.623.)
+        under the same path. (`joern-parse --overlaysonly` is the obvious tool and is broken in 4.0.623: joernio/joern#6283.)
         A failure here is logged and the raw graph kept, so the scan degrades to the old cost rather than
         losing its graph.
         """

src/openultrasast/cpg/queries/overlay.sc

@@ -10,7 +10,7 @@
 //
 // Measured after: the saved graph reloads in 8 s where the raw one took 64 s, and the request that had
 // timed out at 520 s answered in 39 s including the JVM. `joern-parse --overlaysonly` would be the
-// obvious tool and is broken in 4.0.623 (NullPointerException in a post-processing step that needs the
+// obvious tool and is broken in 4.0.623 -- joernio/joern#6283 (NullPointerException in a post-processing step that needs the
 // frontend it did not run), so the once is this script.
 //
 // `save` writes to `workspace/<cpg name>/cpg.bin` under the working directory; the driver moves that over