OneGraph: grounding Gemma 4's code reviews in a real dependency graph instead of a guess

Graphify's tree-sitter dependency graph plus Gemma 4, wired live into PR-Agent as a /graph_risk command, verified against a real pull request.