v0.9.24

Maintenance release. Correctness fixes across extraction, dedup, query rendering, and the sensitive-file filter, plus a hang fix in the .NET/XAML path.

**Fixes**

- The XAML code-behind `.cs` scan is now bounded and prunes noise directories, so it can no longer hang. A standalone extraction on a `.xaml` under a large or shared parent (a temp dir, a big monorepo) could resolve the project root to a broad ancestor and recursively scan the whole tree. It now walks with `node_modules`/`.venv`/`.git`/dot-dir pruning and a directory cap: a real project scans fully, a runaway root degrades to a fast partial scan.
- The sensitive-file filter no longer silently drops topic docs and real source (#2106). Prose files whose slug merely ends in a keyword (`privacy-tokens.md`) and real source like `service_account.py` were dropped with no trace, while some genuine secrets (`.npmrc`, `.pypirc`, `.git-credentials`, case variants) were missed. The filter is now stricter on real secrets and no longer loses legitimate files, and both `graphify extract` and the skill flow now name the skipped files instead of only a count.
- `calls` edges now resolve through an aliased Python import (#2082, thanks @Yyunozor). `from pkg import mod as alias` recorded the import but dropped every downstream `alias.func()` call, so the callee looked like dead code.
- `dedup` preserves a node's attributes when two exact-ID records from the same source file collapse (#2091, thanks @Synvoya). Non-conflicting attributes are retained deterministically, records from different files stay isolated, and a dropped record can never stamp a false origin onto the survivor.
- The `claude-cli` backend now reads the CLI's structured-output channel instead of free-form prose (#2076, thanks @Yyunozor), which had parsed to zero nodes and bisected forever on newer Claude Code.
- `graphify explain` on a high-degree node groups the cut connections by file instead of a bare `... and N more` (#2009, thanks @Yyunozor).
- `graphify query` and MCP `query_graph` no longer print `calls` edges backwards (#2080, thanks @Yyunozor); the renderer recovers the stored direction from the edge.

**Features**

- `get_neighbors` and `get_community` (MCP) now honor a `token_budget` (default 2000) so one call on a god node or large community can't flood the client's context (#2069, thanks @ojmucianski). Truncation is announced at the top of the output.

**Docs**

- `--code-only` is surfaced in the `extract` usage text and README (#2071, thanks @HerenderKumar).
- README troubleshooting note for an older `graphifyy` in system site-packages shadowing `uv run --with graphifyy` (#1540, thanks @HerenderKumar).