feat(query): say why a result set is empty instead of returning a bare 0

`query_graph(pattern="callers_of", target="X")` returned `result_count: 0`
with no signal, and agents read that as "X has no callers". A zero can also
mean the graph cannot see the answer: X was never indexed, the graph is
behind the working tree, or X's language has a known static-analysis blind
spot. Reading it the first way either produces a wrong decision or sends the
agent off to grep the repository, which costs thousands of tokens.

Empty results from query_graph, get_impact_radius, and semantic_search_nodes
now carry a single flat `confidence` string computed in priority order:
target not indexed, graph stale, known language/pattern gap, or a positively
confirmed real absence. The gap table lives in the new uncertainty module as
data, is scoped per pattern so a container-resolution caveat never lands on
file_summary, and every entry was verified against the parser as it stands
today (#819 PHP include/require, #850/#851 PHP container and constructor
injection, #343 npm-aliased imports, #592 Java Spring AOP, plus JS/TS
callbacks and route registration, Go structural interface satisfaction, C# DI
and Python getattr/registry dispatch).

Token cost is the constraint, so the field is emitted only when the result
list is empty — responses that carry results are unchanged — and is capped at
140 characters, measured at +105..+130 chars (~27-33 tokens) on a typical
empty response. That is a saving, not a cost, against the fallback it
prevents.

Everything reaching the client goes through _sanitize_name, has whitespace
collapsed so a crafted node name cannot forge extra lines, and is clipped to
the cap; qualified names drop to their symbol rather than keeping a truncated
directory prefix. Any failure computing the marker degrades to omitting it.

Refs #314

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012fHfGDiZedoxjpKzanHri3