feat(javascript): record Electron integrity mismatches

src/application/javascript/JavaScriptArtifactGraphBuilder.ts

@@ -140,6 +140,13 @@ const graphCoverage = (context: JavaScriptArtifactGraphContext) => {
       null,
     );
   if (unknownGap) return partialApplicationCoverage([], null);
+  if (context.snapshot.integrity_contradictions.length > 0) {
+    const nestedArchiveWasOpaque =
+      context.snapshot.integrity_contradictions.some(({ logical_path }) =>
+        logical_path.toLowerCase().endsWith(".asar"),
+      );
+    return partialApplicationCoverage([], nestedArchiveWasOpaque ? null : 0);
+  }
   return completeApplicationCoverage();
 };
 
@@ -178,6 +185,10 @@ const graphLimitations = (
   );
   return [
     ...context.analysis.limitations,
+    ...context.snapshot.integrity_contradictions.map(
+      ({ logical_path: path }) =>
+        `Artifact integrity metadata contradicts observed bytes at ${path}; the observed bytes are untrusted.`,
+    ),
     ...selfReferenceOmissions(
       relationshipOmissions.selfImports,
       ["import specifier", "import specifiers"],