fix(javascript): preserve builtin identity and share alias traversal

Track module writes and escapes at their owner, preserve capture and reassignment ordering, and share CommonJS/default namespace identity without erasing parent-slot changes. Carry write sites into ambient alias resolution and use parsed write targets across consumers. Deduplicate returned-reference work with cycle context; retain unchanged temporal selection identity so provenance memoization stays effective.

Reviewed fixes include #2041, #2465, #2830, #2881, and #2948. Remove superseded mutation representations and the ineffective per-markValue dedup layer.

Validation: 380 focused JavaScript tests passed under a 384 MiB heap cap, including the previously aborting 30-level/128-call alias regression. Six public CLI/MCP builtin tests passed. Exact pdf.js completed-workflow performance remains unmeasured.

src/domain/javascript/javascriptSemanticReturnedReferences.ts

@@ -74,10 +74,35 @@ export const createSemanticReturnedReferences = (
     const pending: Candidate[] = [
       { node: callee, path: [], bindings: new Set() },
     ];
+    // A shared initializer can be reached through both arms of every alias
+    // diamond. Expand an expression/path again only when its cycle context
+    // permits a binding that an earlier traversal blocked.
+    const expanded = new WeakMap<
+      t.Node,
+      Map<string, readonly ReadonlySet<string>[]>
+    >();
     for (let cursor = 0; cursor < pending.length; cursor++) {
       const item = pending[cursor];
       if (item === undefined) break;
       const node = unwrapJavaScriptExpression(item.node).node;
+      const pathKey = JSON.stringify(item.path);
+      const paths =
+        expanded.get(node) ?? new Map<string, readonly ReadonlySet<string>[]>();
+      const contexts = paths.get(pathKey) ?? [];
+      if (
+        contexts.some((context) =>
+          [...context].every((binding) => item.bindings.has(binding)),
+        )
+      )
+        continue;
+      paths.set(pathKey, [
+        ...contexts.filter(
+          (context) =>
+            ![...item.bindings].every((binding) => context.has(binding)),
+        ),
+        item.bindings,
+      ]);
+      expanded.set(node, paths);
       if (t.isIdentifier(node)) {
         const binding = resolveSemanticBindingState(state, node, node.name);
         if (binding === undefined || item.bindings.has(binding.bindingId))