repo-map.md is stale: python-sdk does pin codeanalyzer-java as an exact PyPI dependency #45

skills/maintaining-cldk/references/repo-map.md, in "The pin chain", states:

The Java backend is bundled/downloaded rather than pinned as a plain PyPI dependency (no codeanalyzer-java== line in python-sdk's pyproject.toml). However, pyproject.toml lines 89–92 contain a [tool.backend-versions] table with codeanalyzer-java = "2.4.1", which is informational only.

Both halves are now out of date. python-sdk/pyproject.toml currently has:

# line 46
java = ["codeanalyzer-java==3.3.3"]
...
# line 89
[tool.backend-versions]
codeanalyzer-java = "3.3.3"

So there is an exact codeanalyzer-java== pin, as an optional extra, and the version is 3.3.3 rather than 2.4.1.

This matters for the propagation sweep specifically. The map as written leads to the conclusion that a Java-side fix needs no python-sdk pin bump, which is the opposite of the truth — an exact pin means no SDK user receives a Java analyzer fix until the pin moves. Hit while sweeping codellm-devkit/codeanalyzer-java#268, where the map's own "verify per repo" instruction is what caught it.

Suggested fix: update the Java bullet to describe the exact pin plus the [tool.backend-versions] table, and treat a Java-side fix the same way as Python and TypeScript for pin-bump purposes. Worth re-verifying the TypeScript and Python numbers in the same pass, since the same drift applies (the local checkout shows codeanalyzer-python = "1.5.3" and codeanalyzer-typescript = "1.6.0", against the map's 0.3.0 / 0.4.3).