fix(graph): remove local snapshot read fallbacks

[jonathanhaaswriter]

Summary

• remove the remaining local snapshot-backed graph read fallbacks from app graph resolution and runtime adapters
• make incremental graph updates fail fast instead of silently rebuilding from local snapshot state
• update graph/readiness tests to assert configured-store-only behavior for the strict Neptune cutover

Validation

• make verify

[jonathanhaaswriter]

I think WaitForReadableSecurityGraph() can still hand callers the empty live builder graph. The new CurrentSecurityGraph() logic correctly falls back to the configured graph when the live graph is empty, but the wait path still returns a.currentLiveSecurityGraph() after WaitForGraph() succeeds. On lease followers / configured-store readers that means the wait succeeds because the store is readable, but callers can still get the empty in-memory graph back.

Can we return a.CurrentSecurityGraph() (or the stored view) after the wait instead of the raw live graph?

[josh-writer]

After removing snapshot-backed reads, CurrentSecurityGraph() now falls back to a.currentLiveSecurityGraph() whenever currentConfiguredSecurityGraphView() returns an error or no view. On read-only replicas, initSecurityGraph() still publishes the builder’s empty graph before checking the writer lease (internal/app/app_security_services.go:528-536), so a Neptune outage/unready store now gets surfaced as a zero-node graph instead of ErrStoreUnavailable.

This is user-visible because API read paths prefer CurrentSecurityGraph() over the store (internal/api/graph_view_resolvers.go:9-12), so graph/risk/intelligence endpoints can silently return empty results during Neptune failures.

[josh-writer]

currentConfiguredSecurityGraphStore() only exposes the configured backend when configuredSecurityGraphReady is true (internal/app/app_graph_store.go:311-316), and syncConfiguredSecurityGraphStore() already flips that flag after all node/edge writes complete (internal/app/app_graph_store_sync.go:12-84).

Returning true for a zero-node backend removes that barrier. On a fresh or cleared Neptune cluster, readers can now observe an empty or partially copied graph while the initial sync is still in progress - which is probably fine, but this is different behavior then previously, where the graph stayed unavailable until sync completion.