improve: `uninitialized-variable` analysis with byte-range lattice and interprocedural function summaries

[SizzleUnrlsd]

Summary

The current uninitialized-variable checks should support real-world cross-function flows, partial writes (struct/array fields), and stable reporting.
This issue tracks the analyzer upgrade completed today and the remaining hardening steps.

Problem

A local-only boolean model (initialized / not initialized) is not precise enough for:

• Partial initialization (p.x written, p.y still uninitialized)
• Cross-function flows (init(&x) then use(x))
• Read-before-write hidden behind helper functions

Implemented Today

• Replaced per-variable boolean state with a byte-range lattice (Uninit / Partial / Init)
• Added tracked memory objects for:
• local allocas
• pointer parameters
• Added function summaries for pointer effects:
• read-before-write ranges
• write ranges
• unknown read/write flags
• Added fixpoint propagation of summaries through the call graph
• Applied callee summaries at call sites to detect ReadBeforeDefiniteInitViaCall
• Added dedicated diagnostic text for call-based reads-before-init
• Added/updated tests for:
• partial array/struct init
• interprocedural write (no warning expected)
• interprocedural read-before-write (warning expected)
• call-chain propagation
• Verified formatting/build/test suite pass (run_test.py: 123/123)

Why This Architecture

• Summary + fixpoint is scalable and composable for interprocedural analysis
• Byte ranges keep precision for partial initialization without exploding complexity
• Two-pass design (summary pass, diagnostic pass) keeps behavior deterministic and testable

Acceptance Criteria

• No warning for init(&value); return value;
• Warning at call-site for return read_value(&value); when value is uninitialized
• Warning propagates through call chains
• Partial struct/array writes still report uninitialized reads on untouched fields/elements
• Human/JSON/SARIF outputs remain coherent with existing rule IDs and severity mapping
• Full analyzer test suite remains green

Follow-up (Optional)

• Support stronger modeling for indirect calls/function pointers
• Add summary caching across modules/build units
• Add confidence tuning for unknown-offset pointer cases