fix(javascript): preserve and resolve complete source-map URLs (#1788)

Keep line-comment URL declarations intact and percent-decode local URL paths
once, preserving raw Evidence identity and artifact-root confinement.

Fixes #1781. Fixes #1782.

Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)

src/application/javascript/JavaScriptArtifactPathResolution.test.ts

@@ -1106,6 +1106,33 @@ describe("contextual JavaScript module identity", () => {
 });
 
 describe("url-reference JavaScript artifact path resolution", () => {
+  it.each([
+    "app%00.js.map",
+    "app%FF.js.map",
+    "app%C0%AF.js.map",
+    "app%2ejs.map",
+    "nested%2fworker.js",
+    "nested%5cworker.js",
+    "../../outside.js.map",
+  ])("rejects an inadmissible URL path: %s", (declaredPath) => {
+    const resolution = resolve({
+      declaredPath,
+      sourcePath: "dist/app.js",
+      context: "url-reference",
+      files: fileMap([
+        file("dist/app.js.map", "root"),
+        file("dist/nested/worker.js", "root"),
+      ]),
+    });
+    expect(resolution).toMatchObject({
+      declared_path: declaredPath,
+      resolution_context: "url-reference",
+      resolution_status: "rejected",
+      resolved_path: null,
+    });
+    expect(resolution.limitations.length).toBeGreaterThan(0);
+  });
+
   it("resolves sibling paths and rejects external URL forms", () => {
     const files = fileMap([
       file("dist/app.js", "root"),