fix(javascript): align module lookup and source evidence

Preserve CommonJS literal paths and confined ESM URL semantics, including package main fallback, directory intent, Unicode identity, and present opaque modules. Parse extraction inputs at their AST/source owner, retain skipped HTML and source-map coverage, and distinguish endpoint candidates from proven receiver facts. Version structural fingerprints with computed literal contents and propagate them through worker contracts.

Reviewed fixes include #1810, #1840, #2642, #2700, #2702, #2714, #2803, #2960, #2968, #2986, #3035, and #3036.

Validation: 158 resolver tests passed; public CLI/MCP module lookup controls, package-main/Unicode workflows, and six builtin workflows passed in the current compiled lane. Worker schema/fingerprint regressions passed. Large public pdf.js completion and real Electron analysis remain unverified.

src/domain/javascript/javascriptArtifactFiles.ts

@@ -1,5 +1,9 @@
 import type { JavaScriptSourceSelection } from "./javascriptSourceSelection.js";
 
+/** Whether an inventoried path has a source extension read by the analyzer. */
+export const isJavaScriptSourcePath = (path: string): boolean =>
+  /\.(?:cjs|cts|mjs|mts|js|jsx|ts|tsx)$/iu.test(path);
+
 /** Relevant file categories projected from the complete artifact inventory. */
 export type JavaScriptArtifactFileKind =
   | "package-json"
@@ -29,6 +33,26 @@ export interface JavaScriptArtifactFile {
       };
 }
 
+/**
+ * One inventoried regular file outside the JavaScript-relevant kinds. Its presence
+ * was inventoried, including unavailable or unhashed members. The source projection
+ * does not read its bytes; references remain present-but-unanalyzed rather than absent.
+ */
+export interface JavaScriptUnanalyzedArtifactFile {
+  readonly path: string;
+  readonly container_sha256: string;
+  readonly sha256: string | null;
+  readonly bytes: number | null;
+  readonly inventory_artifact_id: string | null;
+  readonly limitations?: readonly string[];
+}
+
+/** Borrowed inventory lookup; metadata is materialized only for requested paths. */
+export interface JavaScriptUnanalyzedArtifactLookup {
+  get(path: string): JavaScriptUnanalyzedArtifactFile | undefined;
+  hasDirectory(path: string, containerSha256: string | undefined): boolean;
+}
+
 /** One filesystem-backed ASAR nested beneath a directory input. */
 export interface JavaScriptArtifactContainer {
   readonly path: string;
@@ -40,6 +64,8 @@ export interface JavaScriptArtifactContainer {
 /** Deterministic relevant-file projection plus explicit omissions. */
 export interface JavaScriptArtifactFileSet {
   readonly files: readonly JavaScriptArtifactFile[];
+  /** Borrowed inventory lookup for regular files the source projection does not read. */
+  readonly unanalyzed_files?: JavaScriptUnanalyzedArtifactLookup;
   readonly containers: readonly JavaScriptArtifactContainer[];
   readonly text_bytes_read: number;
   readonly invalid_utf8_files: number;