fix: trace_path returns full caller set across .d.ts-duplicated symbol nodes

[mvanhorn]

What does this PR do?

Root cause is in the trace_path handler in src/mcp/mcp.c: cbm_store_find_nodes_by_name returns all same-named nodes, then pick_resolved_node selects exactly one (sel) via node_resolution_score = label_rank*weight + (end_line - start_line). A body-less .d.ts declaration has span 0, so it always scores below the real implementation, loses the pick, is NOT flagged as a tie, and its callers are dropped — BFS runs only from nodes[sel].id. Fix per the issue's option 2 ("union nodes that share name + signature"): after pick_resolved_node chooses the canonical node, gather the sibling node ids that represent the same logical symbol — same name, callable label (Function/Method), and body-less span (start_line == end_line, the ambient-declaration signal) — and run the inbound/outbound BFS from each, merging cbm_traverse_result_t sets deduplicated by node id before serialization.

When an exported symbol is defined in real source AND re-declared (signature only, no body) in an ambient .d.ts file, the indexer creates two distinct callable nodes for the same logical symbol. CALLS edges from consumers get partitioned across the two nodes by import style: consumers importing via the tsconfig path alias point at the .d.ts stub node, consumers importing via the relative path point at the implementation node. trace_path(function_name, mode=calls) then resolves the name to a single node and returns only that node's callers, silently omitting the rest. Reverse-dependency / blast-radius analysis (the tool's core use case) thus returns a confidently partial answer with no warning.

Fixes #546

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)