refactor!: enforce canonical evidence and provider boundaries

Deliver complete Evidence directly through MCP with required nullable analysis profiles and immutable per-server delivery settings. Bind selected environments at construction and require typed cleanup outcomes with retained retry ownership.

Remove test-only routing, duplicate session and snapshot metadata, producer-field repairs, and ambiguous provider arguments. Separate artifact byte identity from occurrence classification and retain typed source-map and partial native facts across CLI, MCP, and verifier consumers.

BREAKING CHANGE: obsolete Evidence envelopes, session aliases, incomplete snapshots, and missing normalized producer facts are no longer accepted.

src/domain/javascript/javascriptApplicationGraphSchemas.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { javascriptSourceMapReferenceSchema } from "./javascriptSourceMapPaths.js";
 import {
   applicationCoverageSchema,
   applicationGraphEvidenceSchema,
@@ -76,15 +77,23 @@ const applicationPropertiesSchema = z.record(
 );
 
 /** One node observation before its semantic identifier is derived. */
-const applicationNodeObservationInputSchema = z.strictObject({
+const applicationNodeObservationBaseSchema = z.strictObject({
   label: z.string().min(1).nullable(),
+  source_map_reference: javascriptSourceMapReferenceSchema.nullable(),
   properties: applicationPropertiesSchema,
   evidence: applicationGraphEvidenceSchema,
 });
 
+const applicationNodeObservationInputSchema =
+  applicationNodeObservationBaseSchema.extend({
+    source_map_reference: javascriptSourceMapReferenceSchema
+      .nullable()
+      .default(null),
+  });
+
 /** One immutable, evidence-bearing observation attached to an entity. */
 export const applicationNodeObservationSchema =
-  applicationNodeObservationInputSchema.extend({
+  applicationNodeObservationBaseSchema.extend({
     observation_id: prefixedDigestSchema("jag_observation"),
     identifier_strategy: z.strictObject({
       strategy: z.literal("semantic-content-sha256"),