Python: prefilter directly controlled SSA uses

[yoff]

Summary

• Materialize the small (guard, use, branch) control relation before matching shared-SSA definitions.
• Bind both definition and use for the second AdjacentUses::useOfDef lookup.
• Preserve exact guarded-use and query results while avoiding the fused same-definition use-pair expansion.

This is a single query-specific commit stacked directly on #21925 at f7774efbc4502d015f21e001cd399d61f33cc9d9. It intentionally excludes the aggregate migration changes, diagnostics, Airflow sanitizer work, generated artifacts, and expected-file changes.

Evidence

FreeCAD py/modification-of-default-value exact serial controls:

• Maximum guarded-use intermediate: 1,581,023,259 -> 553,851 rows (-99.965%).
• directGuardedUse: exactly 4,993 rows before and after.
• Decoded output SHA-256: 61120da95b48e6a9f3afbbcf82d54fd2775d695a501ae5bc357aefe46410583e.
• Raw BQRS SHA-256: 613ba8a9cac7fae61d2a911178de7eca60e70575dbf4db9dfb526bfb0a4c8967 before and after.
• Warm: 70.603s / 3,314,607,744 joins -> 9.086-9.182s / 153,659,310 joins.
• Cold: 124.350s / 4,318,981,140 joins -> 64.682s / 1,161,966,394 joins.
• Combined cold+warm joins: -82.765%.

The isolated 48-source DCA in github/codeql-dca-main#38969 completed with full target processing. Its interesting summary contained 5 good stage-timing rows, 0 bad rows, with reductions from 20% to 92.8%; no correctness summary was flagged. The experiment compared the exact stable patch ID retained here: 3307faf03796b54c45c6ae0975a083a97811e775.

Validation

• codeql query format --check-only python/ql/src/semmle/python/functions/ModificationOfParameterWithDefaultCustomizations.qll
• git diff --check
• codeql test run python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault (3 tests passed, including BarrierGuardSpecialization.ql)
• Diff from the stacked base: exactly one production file, +7/-2
• Stable patch ID: 3307faf03796b54c45c6ae0975a083a97811e775