tsc_only=True hard-fails on default install: codeanalyzer-typescript pinned to 0.4.1 but --tsc-only needs >= 0.4.2

[rahlk]

Summary

TSCodeAnalyzerConfig(tsc_only=True) is a hard failure on the default install. The new knob unconditionally appends --tsc-only to the analyzer argv, but the repo pins codeanalyzer-typescript==0.4.1, while the flag (per our own docstrings) only lands in >= 0.4.2. Older binaries reject the unknown flag, so the subprocess exits non-zero and the user gets an opaque CodeanalyzerExecutionException.

Found while reviewing the tsc_only work on fix/issue-174 (#174).

Where

• cldk/analysis/typescript/codeanalyzer/codeanalyzer.py:151-152 — appends --tsc-only whenever self.tsc_only is set, with no version guard:

  if self.tsc_only:
      target_args += ["--tsc-only"]

• pyproject.toml:44 — codeanalyzer-typescript==0.4.1 (runtime dependency)
• pyproject.toml:92 — [tool.backend-versions] codeanalyzer-typescript = "0.4.1"

Our own docs already state the requirement:

• cldk/analysis/commons/backend_config.py:86 — "--tsc-only (codeanalyzer-typescript >= 0.4.2)"
• cldk/analysis/typescript/codeanalyzer/codeanalyzer.py:85-87, 149-150 — same >= 0.4.2 note

Reproduce

1. pip install from this branch → pip resolves codeanalyzer-typescript==0.4.1.
2. CLDK.typescript(project_path=..., backend=TSCodeAnalyzerConfig(tsc_only=True)).
3. _init_codeanalyzer builds argv containing --tsc-only, resolves the bundled 0.4.1 binary via codeanalyzer_typescript.bin_path() (no $CODEANALYZER_TS_BIN override in the normal case), and runs subprocess.run(..., check=True).
4. The 0.4.1 binary rejects the unknown flag → non-zero exit → CalledProcessError → re-raised as CodeanalyzerExecutionException(str(e)).

The default path (tsc_only=False) is unaffected; the regression is scoped to anyone who flips the new knob, but for them it fails on the first call with no hint that the bundled binary is too old.

Fix

Preferred: bump the pin to codeanalyzer-typescript==0.4.2 in both pyproject.toml:44 and pyproject.toml:92 once that release is published.

Alternatively (defensive): detect the bundled binary version at _init_codeanalyzer time and either skip the flag with a warning, or raise a clear error that names the required version.