fix(javascript): preserve builtin identity and share alias traversal

Track module writes and escapes at their owner, preserve capture and reassignment ordering, and share CommonJS/default namespace identity without erasing parent-slot changes. Carry write sites into ambient alias resolution and use parsed write targets across consumers. Deduplicate returned-reference work with cycle context; retain unchanged temporal selection identity so provenance memoization stays effective.

Reviewed fixes include #2041, #2465, #2830, #2881, and #2948. Remove superseded mutation representations and the ineffective per-markValue dedup layer.

Validation: 380 focused JavaScript tests passed under a 384 MiB heap cap, including the previously aborting 30-level/128-call alias regression. Six public CLI/MCP builtin tests passed. Exact pdf.js completed-workflow performance remains unmeasured.

src/domain/javascript/javascriptSemanticAnalysis.empty_keys.test.ts

@@ -115,3 +115,18 @@ it("retains exact empty request field names without dynamic fields", () => {
     ),
   ).toEqual(["", "body"]);
 });
+
+it("retains the exact empty CommonJS export name", () => {
+  const ir = analyzeJavaScriptSemantics(`
+    exports[''] = 1;
+    module.exports[''] = 2;
+    exports['ok'] = 3;
+    exports[key] = 4;
+  `);
+  expect(ir.moduleLinks.map(({ exportedName }) => exportedName)).toEqual([
+    "",
+    "",
+    "ok",
+    "*",
+  ]);
+});