perf(javascript): derive the application graph ID once

createJavaScriptApplicationGraph hashed the whole graph to derive its
graph_id, then parsed it with the public schema, whose invariant check
hashed the same content again to verify that ID. Validate the content
with every other invariant first, then derive graph_id once from the
validated copy. The public schema still verifies graph_id for stored
and untrusted graphs, and created graphs are unchanged.

src/domain/javascript/javascriptApplicationGraph.test.ts

@@ -547,6 +547,21 @@ describe("JavaScript Application Graph: source maps and observations", () => {
       /Edge identifier/u,
     );
   });
+
+  it("creates exactly the graph the public schema accepts", () => {
+    const graph = buildSyntheticJavaScriptApplicationGraph();
+    expect(JSON.stringify(graph)).toBe(
+      JSON.stringify(
+        javascriptApplicationGraphSchema.parse(structuredClone(graph)),
+      ),
+    );
+
+    const { graph_id: _graphId, ...semantic } = structuredClone(graph);
+    firstOf(semantic.edges, "edge").edge_id = `jag_edge_${"f".repeat(64)}`;
+    expect(() => createJavaScriptApplicationGraph(semantic)).toThrow(
+      /Edge identifier/u,
+    );
+  });
 });
 
 describe("JavaScript Application Graph: duplicate and orphan rejection", () => {