Share build-time API usage analysis with consumers #114

Follow-up to #109, under v1.0.0 #93. The operation catalog is already generated by the SDK; Toolkit #1658 also needs reusable analysis of consumer source code.

Extract the existing import/call-graph analyzer into an optional @sentry/api/source-analysis build-time entry. Consumers supply source text and the installed SDK's operation catalog, then run the analyzer during their own build. Consumer-specific relationships cannot be precomputed during SDK packaging.

• Share traversal of imports, aliases, references and known request identities, preserving query context and unresolved-request diagnostics.
• Keep factory names, raw-request wrapper conventions, selected query keys and boolean markers configurable. CLI routes, aliases, presentation and destructive-command policy remain in Toolkit.
• Keep TypeScript isolated as an optional peer; ordinary client, browser and catalog imports must work without it.
• Verify source growth, deferred callback boundaries, unknown/private requests and conservative query context, plus actual packed imports and NodeNext declarations.
• Validate an adapter against Toolkit's existing discovery and destructive checks before adopting the published SDK release in #1658.

This extends #109 with a shared analysis tool; it does not move consumer policy into the API catalog or replace #102's type-only operation map.