fix(parse): recognize .spawn() on a dict-of-functions Subscript (calque#189)

[scttfrdmn]

Summary

• Found while investigating whether calque spawn-run could drive AI-Almanac's forecasts_app.py for real: its .spawn() call site is SEASON_BUNDLE_FNS[_model_env(model_id)].spawn(...) — a dict subscript, not a plain name. tools/pyast/pyast.py's _attr_chain only walks Name/Attribute nodes, so this call site's target resolved to an empty string, silently invisible to spawn-run's target-keyed driver (internal/exec/spawnshard.go's BuildSpawnManifests).
• pyast now tracks every function assigned into a module-level dict via NAME[<key>] = some_function (new Collector._callable_dicts), regardless of what <key> is — in this real-world case it's a loop variable, never a literal, so the actual runtime-selected callable genuinely isn't statically resolvable (that limit isn't fixed here, and shouldn't be — it's honest).
• A .spawn() whose receiver is a Subscript on a known such dict now lists every candidate instead of resolving to nothing. internal/parse.SpawnCallSites/new SpawnCallSitesReport expand one SpawnCallSite per candidate (same call args on each, since the real selection can't be known), with a leak noting the expansion — factored into a pure spawnCallSitesFromInvokeCalls helper so the expansion logic is unit-testable without a pyast subprocess.
• cmd/calque/spawnrun.go now uses SpawnCallSitesReport so this expansion leak lands in the same report the caller already prints.

Files touched

• tools/pyast/pyast.py — Collector._callable_dicts, visit_Assign's new NAME[<key>] = func branch, .spawn() handler's candidate lookup.
• internal/parse/parse.go — pyInvokeCall.Candidates, SpawnCallSitesReport, spawnCallSitesFromInvokeCalls.
• internal/parse/parse_test.go — new tests (subprocess-level + pure-Go expansion logic).
• cmd/calque/spawnrun.go — switched to SpawnCallSitesReport.
• testdata/scripts/spawn_dict_dispatch.py — new fixture mirroring forecasts_app.py's real shape exactly.
• CHANGELOG.md.

Test plan

• go build ./... && go vet ./... && gofmt -l . && go test -count=1 ./... — all pass
• golangci-lint run ./... — 0 issues
• ruff check . — all checks passed
• Manually confirmed against a fresh clone of forecasts_app.py: the .spawn() call site now emits {'target': '', 'candidates': ['run_season_forecast_bundle'], ...} instead of {'target': '', ...} with no candidates key at all
• New fixture + 4 new tests: real pyast-subprocess resolution against the fixture, plus pure-Go unit tests for the expansion logic (candidate fanout, and the "no target, no candidates → nothing" regression guard)