IaC catalog: add containment edges for HelmResourceTemplate and HelmLookupReference #2

Plan (optional)

Design-mode entry (designing-cldk-changes): one contract decision on the IaC Neo4j catalog. Spec: codellm-devkit/.github docs/design/specs/2026-09-02-codeanalyzer-iac-helm.md §5 (graph labels and relationships). Parent epic codellm-devkit/.github#52.

Problem

schema.neo4j.json (accepted at e127901) gives a HelmTemplate file edges to its named templates (IAC_DEFINES_TEMPLATE), template calls (IAC_HAS_TEMPLATE_CALL), and value references (IAC_HAS_VALUE_REFERENCE), but no containment edge to its HelmResourceTemplate or HelmLookupReference children. In JSON those children nest under the template's resource_templates{} / lookup_references{}, so containment is implicit; in the graph the only edge that can reach a HelmResourceTemplate is IAC_DERIVED_FROM from a rendered KubernetesResource.

Observed on DayTrader (sample.daytrader.microservices@8a68b59, chart platform/helm): the five *-service.yaml templates each hold a Service document and a {{ if .Values.ocCreateRoute }} Route document. codeanalyzer-iac attributes render provenance only for single-region files (per-region emission counts are not statically knowable through if/range), so those ten HelmResourceTemplate nodes receive no IAC_DERIVED_FROM and, lacking any containment edge, are disconnected islands in Neo4j. Every other L1 child kind has a source-side edge; these two do not.

Scope boundary

In: add two identity-only relationship types to the catalog — IAC_HAS_RESOURCE_TEMPLATE (HelmTemplate → HelmResourceTemplate) and IAC_HAS_LOOKUP_REFERENCE (HelmTemplate → HelmLookupReference) — with ownership codeanalyzer-iac, owned by the template artifact's IaC facet; extend scripts/check_iac.py edge-counterpart invariants (one edge per nested child, L1 onward, monotone); regenerate fixtures. A follow-on work item in codeanalyzer-iac (filed when picked up) copies the accepted bytes, emits the edges in internal/emit/neo4j/project.go, and adds them to the accepted-edge test helper.
Out: changing the single-region provenance rule (per-region rendering is a separate design question); any JSON shape change (resource_templates{} nesting stays).

Goals

• Every HelmResourceTemplate and HelmLookupReference node is reachable from its template artifact in Neo4j regardless of render provenance.
• Edge counterparts are checkable by the semantic checker exactly like IAC_HAS_VALUE_REFERENCE.
• No existing label, property, or relationship changes meaning; the change is additive.

Caveats and known risks

• The catalog is embedded byte-for-byte in codeanalyzer-iac (internal/contract/schema.neo4j.json) and gated by make schema-check; the analyzer PR must land after the schema commit is accepted and pinned.
• IAC_HAS_LOOKUP_REFERENCE has no live-corpus exercise today (neither pinned chart uses lookup); fixture coverage must come from testdata.
• ttl-style naming consistency: follow the existing IAC_HAS_* pattern; do not introduce a generic CONTAINS.

Definition of done

• schema.neo4j.json declares both relationship types with from/to families and ownership; schema.json unchanged.
• scripts/check_iac.py requires exactly one counterpart edge per nested resource_templates{} / lookup_references{} entry at L1, L2, L3, and reports the missing-edge case on a fixture.
• Conformance fixtures updated; checker green on all of them.
• Accepted commit recorded here; codeanalyzer-iac follow-on work item filed and linked as a sub-issue of codeanalyzer-iac — unified IaC backend, Helm first .github#52.