fix(javascript): retain unbound CommonJS semantic imports

Collect unbound literal CommonJS dependencies at the semantic module-link owner, retain null binding names and source provenance, and avoid duplicate links for calls already represented by bindings or re-exports. Preserve distinct nested calls, shadowing exclusions, dynamic binding uncertainty, and existing static asset references.

Fixes #1793.

src/domain/javascript/javascriptSemanticRequireOrigin.ts

@@ -12,11 +12,16 @@ import {
 } from "./javascriptAstValues.js";
 import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
 
+interface JavaScriptRequireOrigin {
+  readonly origin: JavaScriptModuleOrigin;
+  readonly call: t.CallExpression;
+}
+
 /** Recover an unshadowed literal require origin and its exact member path. */
 export const semanticRequireOrigin = (
   node: t.Node | null | undefined,
   state: JavaScriptSemanticAnalysisState,
-): JavaScriptModuleOrigin | undefined => {
+): JavaScriptRequireOrigin | undefined => {
   const members: string[] = [];
   let current = node;
   while (current !== null && current !== undefined) {
@@ -48,5 +53,8 @@ export const semanticRequireOrigin = (
   const specifier = stringValue(current.arguments[0]);
   return specifier === undefined
     ? undefined
-    : { specifier, importedPath: members.reverse() };
+    : {
+        origin: { specifier, importedPath: members.reverse() },
+        call: current,
+      };
 };