fix(router): do not charge children of null-parents in actual costs

[ysmolski]

This fix includes basic and often used cases, but it does not include
some combinations of abstract fields and fragments.
For those I have included the test cases (disabled right now).

I have simplified how parents are used in calculations.
I have added children multiplier to distiungish them from the field cost
which is always multiplied even when null was returned on that field.

This solution can be sophisticated further if there is a need for it.
Potentially, I could take different approach of walking the response
from subgraphs and match them with Cost Tree. That would remove
many heuristics and exceptions and make things much more simple.
But that would happen in a separate PR.

Summary by CodeRabbit

• Bug Fixes
  • Resolver-side cost control is now enabled when cost control is turned on in router configuration, improving enforcement during request execution.
• Chores
  • Updated the GraphQL tools dependency used by the router and router tests to a newer version.

[github-actions]

Router image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-a3a153bd6d13dc633a3efbc5f672bcaec167ad8a

[coderabbitai]

Walkthrough

This PR bumps github.com/wundergraph/graphql-go-tools/v2 in router/go.mod and router-tests/go.mod, and enables resolver-side cost control in ExecutorConfigurationBuilder.Build when RouterEngineConfig.CostControl is enabled.

Changes

Cost Control Enablement

Layer / File(s)	Summary
Cost control flag and dependency bump router/core/executor.go, router/go.mod, router-tests/go.mod	Build now sets ResolvableOptions.EnableCostControl when RouterEngineConfig.CostControl is enabled, and both router module files bump graphql-go-tools/v2 to v2.9.1-0.20260706131125-bfd24a97c56b.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• wundergraph/cosmo#2716: Updates the resolver-side cost control path in related executor and operation-processing code.
• wundergraph/cosmo#2913: Updates the same github.com/wundergraph/graphql-go-tools/v2 dependency in router-related go.mod files.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main fix: preventing child costs from being charged under null parents.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.28%. Comparing base (f704e34) to head (7ef2403).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #3051       +/-   ##
===========================================
+ Coverage   43.43%   61.28%   +17.85%     
===========================================
  Files        1069      261      -808     
  Lines      139019    30604   -108415     
  Branches     7229        0     -7229     
===========================================
- Hits        60385    18757    -41628     
+ Misses      76779    10324    -66455     
+ Partials     1855     1523      -332     

Files with missing lines	Coverage Δ
router/core/executor.go	89.23% <100.00%> (+0.16%)	⬆️

... and 813 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.