analyze.py: version-bump FORCE_EXCLUDE is assumed (not verified) when a candidate has no diff range

[hailcpy]

Problem

In classify() (analyze.py:1031-1039), the only_dep_bump override calls is_pure_version_bump() only when repo and chunk_range are available. Otherwise:

else:
    confirmed = True

Every multi-chunk cluster and every direct-commit candidate has range=None (see cluster() — multi-chunk clusters get None; chunk_commits() direct mode returns all-None ranges). So for exactly those candidates, the "pure version bump" claim is assumed rather than checked, and the candidate is force-excluded as skip.

A dependency replacement (swap lib X for lib Y) whose commits start with fix/chore and touch only manifest files, spread across commits that cluster together, is silently dropped — the opposite of the documented behavior ("only version numbers changed ⇒ exclude; structural change ⇒ keep").

Fix

When no aggregate range exists, verify per-commit instead: for each commit in the candidate, run is_pure_version_bump(repo, f"{sha}^", sha, dep_paths) (using the empty-tree hash for root commits). All commits pure ⇒ confirmed. Any structural change ⇒ not confirmed; fall through to normal scoring (or classify as borderline).

Acceptance

• Fixture: two clustered chore: commits that together remove package A and add package B in a manifest ⇒ NOT excluded.
• Fixture: clustered commits that only move version literals ⇒ still excluded.