[akhilp117]

This is part 1 of 2 for ENG-8951 which checks request payloads passed to same-file helpers. The S025-S028 input rules only look inside a public endpoint method, so a raw read or a serializer inside a helper the method calls is never reported. This PR is just the groundwork. It changes no output.

• Every top-level function and method now gets a ctx (_InputCtx), not just public HTTP methods. Each ctx is stored by scope, like MyEndpoint.get or build_query
• Reporting moves from the end of each method to the end of the module walk. Only public methods are reported, so the result is the same, but every function's "facts" exist when reporting starts
• Decorators, defaults and annotations are visited before the function's ctx is pushed, so @extend_schema calls aren't counted as part of the function
• Each function records the calls it makes to possible helpers: helper(), self.helper() and super().helper(), which arguments carry request input, and whether the call has *args or **kwargs
• A method defined twice (i.e, using if/edlse branches to define def helper() or using @overload then the real def) is reported once per definition. _functions (which is a dict of scope : the functions ctx) is only used for looking a function up by name, and reporting goes through every ctx in file order

Nothing reads the recorded calls yet. #130267 follows same-file helpers and reports their reads under the public method

[linear-code]

ENG-8951

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 8e62754. Configure here.}