v0.9.76

More language-structure coverage, resolution/dedup correctness, and a security fix for the git-hook installer.
- Feature: four more language extractors gained type coverage from @rajatnagda45 — **Zig** tagged-union variants (`union(enum)`) emit a node per variant with a `case_of` edge (#4050), **C++** `union` specifiers are extracted as class-like type nodes with their members (#4052), **VB.NET** enum members link via `case_of` instead of `contains` (which also stops a member named like a type binding as a constructor) (#4054), and **Pascal** enumerated types and their values are extracted (#4056).
- Feature: three **Scala** type-reference fixes shipped together earlier in the day are followed here by @Faisal-Fayaz's extractor hardening — graphify now stops walking JSON Schema files as config manifests, keyed on a `$schema` declaration plus a structural marker (`$defs`/`definitions`/`$id`) so real manifests that merely reference a schema are unaffected (#4048, #2255).
- Fix: **Elixir** `import`/`use` call scoping is now per-module rather than per-file, so an unqualified call in one module no longer resolves against another module's imports in the same file (#4058, refines #4015).
- Fix: track calls to external **Python** modules — a `module.func()` call to a plainly-imported dependency now records a `calls` edge to that module, fail-closed (receiver-shadowing and non-unique bindings are skipped, builtins and unresolved locals are never fabricated) (#4043, #3793, thanks @oleksii-tumanov).
- Fix: **Svelte** files now feed only their `<script>` blocks to the AST pass (masking the template and style, preserving line numbers), so the markup no longer produces a parse error that dropped every symbol (#3984, #3928, thanks @Agnik47).
- Fix: **PHP** language constructs (`isset`, `empty`, `list`, `eval`, ...) no longer bind as calls to a user method that happens to share the name (#3975, #3830, thanks @Cintu07).
- Fix: an unresolved base class whose only same-named definition lives in another language is kept unresolved instead of binding across languages; same-language cross-file inheritance still resolves (#4068, thanks @SrijanSriv).
- Fix: unstamped document nodes with the same heading in different files are no longer merged together during dedup; same-file document twins still merge (#4065, thanks @SrijanSriv).
- Fix: `graphify path` and the MCP `shortest_path` tool resolve a `path::symbol` or raw node-id endpoint to the exact node before falling back to fuzzy scoring, and refuse an ambiguous endpoint instead of silently picking one (#3935, #3913, thanks @bercedev).
- Fix: cross-repo resolver confidence scores are snapped to the canonical INFERRED rubric (a label-only change; no edge is added, dropped, or reclassified) (#4046, #4045, thanks @DeepanshuPal).
- Fix: `graphify` no longer indexes its own installed skill folders and whole-written rule/hook files when scanning a project, keyed on the exact install locations so a user's own `graphify`-named folder is not skipped (#4062, #4057, thanks @Mpasha17).
- Fix: the suggested questions in the analysis output are diversified across signal types with a round-robin, so one category no longer crowds out the others (#3972, #3849, thanks @azizur100389).
- Security: `graphify hook install` refuses a `core.hooksPath` that resolves outside the repository (resolving both sides, symlink-safe), falling back to the in-repo `.git/hooks` instead of writing an executable outside the checkout; legitimate in-repo custom hook paths, linked worktrees, and submodules still work (#3919, #3869, CWE-22, thanks @nothariharan).
- Chore: the PyPI package page now points Homepage at graphify.com and adds a Documentation link to docs.graphify.com; Repository and Issues stay on GitHub (#4069, thanks @SyedFahad7).