fix(javascript): read utilityProcess.fork options from the argv slot (#6280)

Electron's utilityProcess.fork(modulePath[, args][, options]) treats a
non-array object in the second argument as the options and ignores the
third. The static extractor only read the third argument, so
`fork("./worker.js", { serviceName })` lost the declared name while
reporting exact, complete coverage, and an object in the second slot let
an ignored third argument supply the name.

Move the optional-argv options selection that child_process already used
into the shared expression-shape owner and reuse it for utility
processes. Unproven argv shapes, spreads and identifier options remain
unknown with partial coverage; nullish options or a nullish serviceName
declare no name, matching Electron's runtime checks.

Fixes #6208

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

src/domain/javascript/javascriptStaticAnalysisState.ts

@@ -2,6 +2,7 @@ import type * as t from "@babel/types";
 import type { JavaScriptOpenReceiverFact } from "./javascriptSemanticAnalysis.js";
 import type { JavaScriptRpcScan } from "./javascriptRpcEndpoints.js";
 import type { JavaScriptStaticPathIntrinsicQuery } from "./javascriptStaticAnalysisHelpers.js";
+import type { JavaScriptExpressionShapeResolver } from "./javascriptSemanticExpressionShapes.js";
 
 import type {
   JavaScriptBundlerRegistration,
@@ -91,6 +92,8 @@ export interface JavaScriptFindingContext {
   /** Node path.resolve identity established by shared callee and mutation owners. */
   readonly nodePathResolve?: JavaScriptStaticPathIntrinsicQuery;
   readonly rpcScan: JavaScriptRpcScan;
+  /** Shared bounded argv/nullish argument shapes for optional-slot signatures. */
+  readonly expressionShapes: JavaScriptExpressionShapeResolver;
   readonly source: string;
   readonly accumulator: JavaScriptAnalysisAccumulator;
   readonly vitePreloadDependencyTable: readonly (string | undefined)[] | null;