fix(ci): align static checks and regression fixtures with current contracts (#7349)

* fix(ci): retire unused internal analysis declarations

* test: use an admitted app bundle for provider routing

(cherry picked from commit 00aa17f12a)

* test: keep bundle routing coverage outside oversized group

(cherry picked from commit 8658353b0d)

* fix(ci): align regression fixtures with current admission contracts

* test: bind extraction close fixtures to their ZIP digest

(cherry picked from commit 626d0250db)

* test(cli): match typed analysis outcomes in function detail fixture

* test(ghidra): preserve empty Java property separator framing

* test(electron): retain unknown IPC ownership for native module gaps

* fix(electron): share source-scoped call path identity

* test(captures): assert safe source identity on SAZ refusal

* test(apple): match root occurrence kind to inventory manifest

* fix(examples): align directory root occurrence identity

* test(electron): align equivalent fixture assertions with upstream

* test(process): assert retained capture root identity

* test(windows): declare the PE fixture optional header

* test(ci): refresh owned registration and verifier fixtures

* test(setup): use owned registrations for refresh fixtures

* test(process): control unavailable ownership in CLI cleanup fixture

* test(process): guard controlled compiler output arguments

* test(setup): align equivalent entrypoint guards with upstream

* test(process): release the cleanup target through an owned gate

* test(ci): align semantic identities and owned fixture facts

* test(pcap): retain the upstream DNS wire fixture branch

* test(pcap): use the canonical wire ownership fixture

* test(pcap): assert exact DNS wire query labels

* test(ci): preserve admission and ownership fixture prerequisites

* test(ci): align authenticated fixture and cleanup boundaries

* test(windows): align native artifact fixtures with upstream

* test(android): request complete evidence for inline MCP contracts

* test: avoid pinning diagnostic wording

* test: verify cleanup diagnostics at their source

* test: strengthen evidence and cleanup checks

* test: avoid pinning registration guidance

---------

Co-authored-by: Plastic-time <Plastic-time@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

src/application/javascript/ElectronBoundaryGraphCallPaths.ts

@@ -2,7 +2,7 @@ import { javascriptSourceRangeKey } from "../../domain/javascript/javascriptSour
 import type { ApplicationNode } from "../../domain/javascript/javascriptApplicationGraphSchemas.js";
 import type { ElectronCallPath } from "../../domain/javascript/electronStaticAnalysisTypes.js";
 import type { JavaScriptArtifactFile } from "../../domain/javascript/javascriptArtifactFiles.js";
-import { sha256Text } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+import { electronCallPathId } from "./ElectronCallPathIdentity.js";
 import type {
   ElectronIpcContext,
   ElectronIpcRecord,
@@ -36,7 +36,7 @@ export const addElectronCallPaths = (
     if (javascript === null) continue;
     const coverage = javascriptAnalysisCoverage(javascript);
     for (const path of javascript.electron.call_paths ?? []) {
-      const pathId = sha256Text(JSON.stringify([file.path, path]));
+      const pathId = electronCallPathId(file.path, path);
       const nodes = path.steps.map((step, index) =>
         context.accumulator.addNode({
           kind: "javascript-expression",

src/application/javascript/ElectronCallPathIdentity.ts

@@ -0,0 +1,8 @@
+import type { ElectronCallPath } from "../../domain/javascript/electronStaticAnalysisTypes.js";
+import { sha256Text } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+
+/** Keep wrapper-path identity source-scoped across both graph projections. */
+export const electronCallPathId = (
+  filePath: string,
+  path: ElectronCallPath,
+): string => sha256Text(JSON.stringify([filePath, path]));

src/application/javascript/JavaScriptSemanticGraphElectronProjection.ts

@@ -1,6 +1,6 @@
 import type { ElectronCallPath } from "../../domain/javascript/electronStaticAnalysisTypes.js";
 import type { JavaScriptArtifactFile } from "../../domain/javascript/javascriptArtifactFiles.js";
-import { sha256Text } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+import { electronCallPathId } from "./ElectronCallPathIdentity.js";
 import {
   addSemanticGraphRelation,
   retainSemanticGraphNode,
@@ -16,7 +16,7 @@ export function* projectElectronSemanticCallPaths(
 ): Generator<void, void> {
   for (const path of paths) {
     yield;
-    const pathId = sha256Text(JSON.stringify(path));
+    const pathId = electronCallPathId(file.path, path);
     let previous: ReturnType<typeof retainSemanticGraphNode> = null;
     let previousKind: ElectronCallPath["steps"][number]["kind"] | undefined;
     for (const [index, step] of path.steps.entries()) {