fix(javascript): exclude overwritten Electron API identities (#1664)

* fix(javascript): exclude overwritten Electron API identities

* test(javascript): bind Electron in file-base path fixture

* test(electron): bind BrowserWindow in preload override fixtures

* test(mcp): allow cold catalog validation in runtime probe

* test(electron): bind APIs in option reconstruction fixtures

src/application/javascript/JavaScriptArtifactGraphBuilder.ts

@@ -1,3 +1,4 @@
+import { ELECTRON_IDENTITY_LIMITATION } from "../../domain/javascript/javascriptElectronMemberWrites.js";
 import type { ArtifactInventorySnapshot } from "../../domain/artifactInventorySnapshot.js";
 import {
   createJavaScriptApplicationGraph,
@@ -255,6 +256,11 @@ const graphLimitations = (
     "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
     "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
     "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
+    ...(context.analysis.files.some(({ javascript }) =>
+      javascript?.limitations.includes(ELECTRON_IDENTITY_LIMITATION),
+    )
+      ? [ELECTRON_IDENTITY_LIMITATION]
+      : []),
     ...(electronFindings === 0
       ? []
       : [

src/application/javascript/JavaScriptArtifactPathResolution.test.ts

@@ -1015,6 +1015,7 @@ describe("contextual JavaScript module identity", () => {
   it("retains CommonJS and ESM file-base identity during inert extraction", () => {
     const analysis = analyzeJavaScriptStaticSource(
       `
+        import { BrowserWindow } from "electron";
         new BrowserWindow({ webPreferences: {
           preload: path.resolve("ignored", __dirname, "preload.cjs")
         }});