fix(javascript): preserve builtin identity and share alias traversal

Track module writes and escapes at their owner, preserve capture and reassignment ordering, and share CommonJS/default namespace identity without erasing parent-slot changes. Carry write sites into ambient alias resolution and use parsed write targets across consumers. Deduplicate returned-reference work with cycle context; retain unchanged temporal selection identity so provenance memoization stays effective.

Reviewed fixes include #2041, #2465, #2830, #2881, and #2948. Remove superseded mutation representations and the ineffective per-markValue dedup layer.

Validation: 380 focused JavaScript tests passed under a 384 MiB heap cap, including the previously aborting 30-level/128-call alias regression. Six public CLI/MCP builtin tests passed. Exact pdf.js completed-workflow performance remains unmeasured.

src/domain/javascript/javascriptIntrinsicInvocation.test.ts

@@ -0,0 +1,54 @@
+import { expect, it } from "vitest";
+import * as t from "@babel/types";
+
+import { createSemanticModuleInterop } from "./javascriptModuleInterop.js";
+import { parseJavaScriptSource } from "./javascriptSourceParser.js";
+import { indexJavaScriptBindingsSteps } from "./javascriptSemanticAnalysis.js";
+import {
+  completeSemanticSteps,
+  traverseJavaScriptAst,
+} from "./javascriptSemanticTraversal.js";
+
+const invocationKinds = (source: string) => {
+  const parsed = parseJavaScriptSource(source);
+  if (parsed === null) throw new Error("invocation fixture did not parse");
+  const state = completeSemanticSteps(
+    indexJavaScriptBindingsSteps(parsed.program),
+  );
+  const interop = createSemanticModuleInterop(state);
+  const invocations: (ReturnType<typeof interop.intrinsicInvocation> | null)[] =
+    [];
+  traverseJavaScriptAst(parsed.program, {
+    enter: (node) => {
+      if (t.isCallExpression(node) || t.isOptionalCallExpression(node))
+        invocations.push(interop.intrinsicInvocation(node) ?? null);
+    },
+  });
+  return invocations;
+};
+
+it.each([
+  'const change = Object.defineProperty.call; change(null,Object,"create",{value:customCreate});',
+  'const {apply:change} = Object.defineProperty; change(null,[Object,"create",{value:customCreate}]);',
+  'const change = Reflect.apply.call; change(null,Object.defineProperty,null,[Object,"create",{value:customCreate}]);',
+])(
+  "keeps a bare invocation member alias unknown, not effect-free: %s",
+  (source) => {
+    expect(invocationKinds(source)).toEqual([
+      expect.objectContaining({ kind: "opaque" }),
+    ]);
+  },
+);
+
+it("keeps a comma-expression intrinsic call unknown when its receiver is erased", () => {
+  expect(
+    invocationKinds(
+      '(0, Object.defineProperty.call)(null, Object, "create", {value: customCreate});',
+    ),
+  ).toEqual([
+    expect.objectContaining({
+      kind: "opaque",
+      path: ["intrinsic", "Object", "defineProperty", "call"],
+    }),
+  ]);
+});