fix(gfql): reject cross-kind WITH rebinds early

[lmeyerov]

Scope

Addresses #1937 item 2 only; this PR does not close the issue.

The local Cypher compiler now rejects a WITH projection that rebinds a bare MATCH-bound whole-entity alias onto another live MATCH-bound entity alias, including node-to-edge and edge-to-node cases. These shapes previously escaped the same-kind guard and could resolve rows and properties against different bindings. The decline uses the existing typed E108 contract.

Final stack

• Base: master, exact prepared base 222799c6e2890536080f68cb0e6e7f957124d77c
• Head: dd044ea4d68c6f9e529b5de693d31b341d2d28ed
• Linear delta: four one-parent commits, zero merge commits
  • 9b5ba26d9 — reject cross-kind WITH rebinds early
  • 36090a8c5 — tighten scalar rebind error contracts
  • 914e351c3 — type the cross-kind boundary tests
  • dd044ea4d — add the release changelog entry
• Incremental scope: three files, +36/-19
  • CHANGELOG.md
  • graphistry/compute/gfql/cypher/lowering.py
  • graphistry/tests/compute/gfql/test_alias_scoping_semantics.py

Boundary contract

Error side, asserted directly at compile time:

• node alias onto a live edge alias → exact E108, value a AS r
• edge alias onto a live node alias → exact E108, value r AS b
• existing node-to-node and edge-to-edge live-alias rebinds remain exact typed declines

Safe and adjacent controls remain unchanged:

• self-renames and plain carries
• fresh whole-entity targets
• property/scalar projections that shadow a live alias name
• terminal RETURN a AS b
• WITH output consumed by a reentry MATCH
• earlier, more specific UNWIND-collision validation
• the existing scalar-then-property typed error contract

Review resolution

The sole review question asked whether both sides of the error boundary were sufficiently tested. The final test matrix covers both cross-kind error directions plus same-kind errors, scalar/property vs entity sources, live vs fresh/reentry targets, carries/self-renames, terminal RETURN, and validation precedence.

Validation

CPU/code gates only; no Docker, cuDF/GPU, DGX, or broad local suite:

• focused boundary tests: 40 passed / 54 deselected
• strict added-line audit: zero Any, object, cast, getattr, setattr, hasattr, unqualified List/Dict, or broad str annotations
• ./bin/lint.sh: pass, including Ruff, type-hygiene, comment-density, and relative-import guards
• ./bin/typecheck.sh: pass, mypy 2.3.1, 336 source files
• git diff --check: pass
• changelog: added under [Development] → Fixed

Landing

Maintainer-authorized merge-commit landing with admin override only after this exact head is fully green. Retain the source branch.