feat(javascript): analyze selected application sources

Analyze exact selected sources in first-request order before unrelated
static scopes, preserving full artifact identity and byte verification.
Retain selection in CLI/MCP Evidence and summaries, with explicit unknowns
and partial coverage for unselected sources. Keep default full analysis.

Fixes #1848

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

src/domain/javascript/javascriptSourceSelection.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+
+/** Exact inventoried paths selected for text acquisition and static analysis. */
+export const javaScriptSourcePathsSchema = z
+  .array(z.string().min(1))
+  .min(1)
+  .describe(
+    "Exact relevant file paths from the artifact inventory, relative to the application root, analyzed in first-request order before unselected scopes; no globs or implicit dependencies. Omit to analyze all sources.",
+  );
+
+/** Caller scope retained independently of analysis success or completeness. */
+export const javaScriptSourceSelectionSchema = z.strictObject({
+  requested_paths: javaScriptSourcePathsSchema,
+  unselected_files: z.number().int().min(0),
+});
+
+/** Explicit selected-source boundary for an otherwise complete inventory. */
+export type JavaScriptSourceSelection = z.infer<
+  typeof javaScriptSourceSelectionSchema
+>;