fix(cpg): null-guard method access in the query scripts -- a class-level call aborted the whole taint batch

On real PHP source (CPS-IT/mailqueue) a call outside any method has a null
.method; inScope/nestedInLabeled dereferenced it (NullPointerException) and the
script exited 1, losing every taint answer for the repository. 16 sites in
taint/dominance/config/vocabulary.sc now treat a null method as out of scope;
non-null behaviour is unchanged (same outputs on the repro graph for the other
scripts). Static regression test added. Implemented with Codex.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test_cpg_queries_compile.py

@@ -20,6 +20,7 @@ host's pytest mounted in, which needs no network and installs nothing:
 from __future__ import annotations
 
 import json
+import re
 import subprocess
 from pathlib import Path
 
@@ -28,6 +29,18 @@ import pytest
 QUERIES = Path("src/openultrasast/cpg/queries")
 
 
+@pytest.mark.parametrize("name", ["taint", "dominance", "config", "census", "overlay", "vocabulary"])
+def test_query_scope_checks_guard_nullable_methods(name: str) -> None:
+    """PHP class constants can have no method; one unsafe scope check aborts the batch."""
+    script = QUERIES / f"{name}.sc"
+    source = script.read_text()
+    assert source, f"{script} is empty"
+    # Require Option(node.method).exists(predicate), keeping the null guard at the call site.
+    unsafe = re.compile(r"\b(?:inScope|nestedInLabeled)\s*\(\s*[\w.]+\s*\.\s*method\s*\)")
+    sites = [source.count("\n", 0, match.start()) + 1 for match in unsafe.finditer(source)]
+    assert not sites, f"{script}: unguarded method scope checks at lines {sites}"
+
+
 def _joern() -> str | None:
     import shutil