Fix v0.5.0 prerelease review findings

[tob-scott-a]

Summary

• Replace .trailmark/links.toml entry-level external with per-endpoint source_external and target_external, and reject unknown top-level/link keys.
• Retain Solidity base entrypoints for overridden methods and annotate them with solidity_overridden_by instead of suppressing them.
• Tighten SQL procedure fallback parsing for comments and same-name schema/table node collisions.
• Replace TypeScript receiver regex inference with AST-scoped assignment resolution.
• Add GraphStore.unit() and use it from attack_surface() to avoid new private graph access.
• Update README, changelog, and regression tests for the prerelease behavior changes.

Tests

• uv run ruff format src/ tests/
• uv run ruff check src/ tests/ -> All checks passed
• ty check -> All checks passed
• uv run pytest -q tests/ -> 1203 passed

Notes

• No KAT fixture diffs were needed.
• .github/, pyproject.toml, version metadata, and uv.lock were not changed.

[tob-scott-a]

@claude review once