perf: bound helper-map summary reduction

[picatz]

Summary

• Replace helper-map CFG path materialization with a query-local explicit DFS, preserving ordered effect union, dedupe-before-remapping, and legacy all-path kill decisions.
• Index events once, distinguish cycles from shared joins, preserve return and same-instruction event ordering, and retain the legacy collector only as a bounded test oracle.
• Add 10,000 fixed-seed differential cases, explicit cursor boundaries, valid SSA branch/loop/early-return cases, 64-diamond finite-work coverage, allocation benchmarks, and scoped complexity documentation.

This is performance-only. Labeled inherited nested-helper precision limitations remain unchanged; map-range helpers and alias expansion are outside this change. Complexity is scoped to already-built events, with explicit block accounting and no whole-analyzer linearity claim.

Validation

• Focused tests pass on Go 1.27.2. The legacy oracle matches exact ordered effects and kill decisions; explicit tests cover shared killed joins, gray cycles, before/end cursors, weak kills, tied write/kill order, repeated returns and metadata distinctions.
• Exact detailed diagnostics, callgraph paths and every evidence field match the legacy collector over 17 valid-SSA fixtures.
• All 15 precision snapshots pass unchanged. Ground-truth report remains 8 TP / 5 known FN / 0 FP.
• Independent hash-pinned production review found no blocking issue. A separately written exhaustive cursor-graph model matched 444,528 cases; this supplements rather than replaces the Go/SSA tests.
• All eight hosted checks passed for final head 5dd67b4: Go 1.26.9 / 1.27.2 builds and whole-repository tests, root/callgraph and wholeprogram/CLI race jobs, vet, staticcheck and govulncheck.

Allocation measurements

At 12 diamonds / 37 blocks, complete helper-summary allocation is 8,672 B / 62 allocs per query, versus 24,615,976 B / 73,644 allocs at the base. All three repetitions agree. SSA setup is excluded.

Isolated reduction including event indexing is a separate benchmark: legacy 24,613,664 B / 73,596 allocs versus finite 6,360 B / 14 allocs, also stable across three repetitions. Shared-host timings are not used as throughput/speedup evidence.

No release or tag.