Summary

The TypeScript backend (TSCodeanalyzer) shells out to the packaged
codeanalyzer-typescript (cants) binary. That binary exposes a
--call-graph-provider <tsc|jelly|both> option (default tsc). The both
(and jelly) provider machinery is obsolete — the resolver-based tsc
provider is the only supported path going forward.

Today the SDK never passes --call-graph-provider, so it implicitly rides on
the binary default. We should make our intent explicit and stop depending on
the obsolete both provider.

Findings

• cldk/analysis/typescript/codeanalyzer/codeanalyzer.py builds the binary
  args from -i, -a, -o, -t only — --call-graph-provider is never
  passed (verified: the string appears nowhere in the repo).
• cants --help (codeanalyzer-typescript 0.4.1) still advertises
  --call-graph-provider <name> call-graph backend: tsc (default) | jelly | both.
• pyproject.toml pins codeanalyzer-typescript==0.4.0; latest on PyPI is
  0.4.1.

Proposed work

1. Treat --call-graph-provider both as obsolete — do not expose or rely on it
   from the SDK.
2. Pin codeanalyzer-typescript to the latest PyPI release (0.4.1).
3. Surface a configurable tsc_only toggle (default False) on the TypeScript
   codeanalyzer config. When enabled, the backend pins the provider to the
   resolver path (--call-graph-provider tsc) instead of the obsolete both.