fix(cypher): unify repeated variable-length nodes

[jstar0]

What does this PR do?

Part of #797. This is the repeated-node-variable fix split from #883 as requested in maintainer review.

Variable-length expansion currently overwrites an existing terminal-node binding with each BFS result. As a result, a pattern such as MATCH (f)-[:CALLS*1..2]->(f) can return paths ending at a different node even though both f occurrences must identify the same node.

The change applies the same binding-unification rule already used by fixed-length relationships: when the terminal variable is bound, variable-length expansion only accepts traversal results with the same node id.

This PR intentionally does not include the trail-enumeration semantics, BFS fork, row cap, or related tests from #883.

Verification

make -f Makefile.cbm test
make -f Makefile.cbm lint-ci
make -f Makefile.cbm security

The focused Cypher suite passes 171 tests. The repository lint and all eight security layers pass. The full test target reaches and passes the changed Cypher suite; unrelated subprocess and install-staging failures reproduce on the exact unmodified main base in the same environment.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects unsigned commits
• New behavior is covered by a reproduce-first test
• Lint passes
• Security checks pass

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for the repeated-variable-length-node fix and its Cypher regression coverage. It is now routed as a high-priority query-correctness PR in 0.9.1-rc. This is triage rather than approval; our review queue is currently full, so the full semantic and performance review may take a little time.