fix(javascript): retain unbound CommonJS semantic imports

Collect unbound literal CommonJS dependencies at the semantic module-link owner, retain null binding names and source provenance, and avoid duplicate links for calls already represented by bindings or re-exports. Preserve distinct nested calls, shadowing exclusions, dynamic binding uncertainty, and existing static asset references.

Fixes #1793.

src/domain/javascript/javascriptSemanticAnalysis.member_depth.test.ts

@@ -39,7 +39,7 @@ it("preserves a 12,000-member native import through both analyzers", () => {
   ]);
 });
 
-it("retains a deep CommonJS re-export path without inventing dynamic module links", () => {
+it("retains deep CommonJS paths and dependencies without inventing dynamic bindings", () => {
   const ir = analyzeJavaScriptSemantics(`
     module.exports.result = require("./dependency.js")${ordinaryMemberChain}.last;
     const dynamic = require("./other.js")${ordinaryMemberChain}[key].last;
@@ -51,6 +51,13 @@ it("retains a deep CommonJS re-export path without inventing dynamic module link
       importedName: "last",
       exportedName: "result",
     }),
+    expect.objectContaining({
+      kind: "require",
+      specifier: "./other.js",
+      importedName: null,
+      localName: null,
+      exportedName: null,
+    }),
   ]);
   expect(onlyBinding(ir, "dynamic").provenance).toMatchObject({
     status: "unknown",