fix(javascript): preserve builtin identity and share alias traversal

Track module writes and escapes at their owner, preserve capture and reassignment ordering, and share CommonJS/default namespace identity without erasing parent-slot changes. Carry write sites into ambient alias resolution and use parsed write targets across consumers. Deduplicate returned-reference work with cycle context; retain unchanged temporal selection identity so provenance memoization stays effective.

Reviewed fixes include #2041, #2465, #2830, #2881, and #2948. Remove superseded mutation representations and the ineffective per-markValue dedup layer.

Validation: 380 focused JavaScript tests passed under a 384 MiB heap cap, including the previously aborting 30-level/128-call alias regression. Six public CLI/MCP builtin tests passed. Exact pdf.js completed-workflow performance remains unmeasured.

src/domain/javascript/javascriptSemanticValues.memo.test.ts

@@ -86,7 +86,7 @@ it("invalidates retained alias values at the producing mutation boundary", () =>
   expect(
     property(property(evaluateSemanticBinding(root, state), "alias"), "value"),
   ).toEqual({ status: "literal", value: 1 });
-  target.mutatedPaths.push(["value"]);
+  target.memberWrites.push({ path: ["value"], node: undefined });
   clearSemanticValueCaches(state);
   expect(
     property(property(evaluateSemanticBinding(root, state), "alias"), "value")