fix(settings): classify caller-selected limits as parameter updates

analysis_timeout_ms, max_heap_mb, and command_timeout_ms keep the source chosen by the caller, the runtime override, or the built-in default. A request value reports update_mode parameter because update_analysis_settings cannot change that call.

src/domain/javascript/javascriptSourceAnalysis.ts

@@ -41,7 +41,21 @@ export interface JavaScriptSourceAnalysisFailure {
 export interface JavaScriptSourceAnalysisLimits {
   readonly semanticPrecision?: JavaScriptSemanticPrecisionInput;
   readonly heapMb: number;
+  /** Where `heapMb` was selected. Absent when the caller did not record it. */
+  readonly heapSource?:
+    | "default"
+    | "setting"
+    | "runtime"
+    | "request"
+    | undefined;
   readonly timeoutMs: number;
+  /** Where `timeoutMs` was selected. Absent when the caller did not record it. */
+  readonly timeoutSource?:
+    | "default"
+    | "setting"
+    | "runtime"
+    | "request"
+    | undefined;
 }
 
 /** Sequential source-analysis authority with independently verified cleanup. */