refactor!: enforce canonical evidence and provider boundaries

Deliver complete Evidence directly through MCP with required nullable analysis profiles and immutable per-server delivery settings. Bind selected environments at construction and require typed cleanup outcomes with retained retry ownership.

Remove test-only routing, duplicate session and snapshot metadata, producer-field repairs, and ambiguous provider arguments. Separate artifact byte identity from occurrence classification and retain typed source-map and partial native facts across CLI, MCP, and verifier consumers.

BREAKING CHANGE: obsolete Evidence envelopes, session aliases, incomplete snapshots, and missing normalized producer facts are no longer accepted.

src/domain/javascript/javascriptApplicationVersionKeys.ts

@@ -1,3 +1,4 @@
+import { canonicalJson } from "../comparisonSemantics.js";
 import { compareCodePoints } from "../canonicalOrdering.js";
 import type { ApplicationNode } from "./javascriptApplicationGraph.js";
 import type { JsonValue } from "../jsonValue.js";
@@ -195,7 +196,7 @@ const moduleSourceDigestKey = (node: ApplicationNode): string | null => {
 const sourceMapKey = (node: ApplicationNode): string | null =>
   node.kind === "source-module" &&
   node.identity.strategy === "source-map-original"
-    ? `source-map\0${node.identity.original_source}`
+    ? `source-map\0${canonicalJson([node.identity.source_root, node.identity.original_source])}`
     : null;
 
 const structuralFingerprintKey = (node: ApplicationNode): string | null => {