fix(javascript): preserve incoming callback target uncertainty (#4243)

Preserve incoming callback uncertainty and resolve proven preceding writes.
Share read-position and initializer identity facts with returned-reference
analysis; cache completed projected work with actual cycle dependencies.

Fixes #3880

src/domain/javascript/javascriptSemanticCalls.ts

@@ -50,7 +50,10 @@ interface CallCollectionContext {
   readonly state: JavaScriptSemanticAnalysisState;
   readonly callableById: ReadonlyMap<string, JavaScriptSemanticCallable>;
   readonly output: MutableCallAnalysis;
-  readonly bindingResolutionCache: Map<string, LocalCallableResolution>;
+  readonly bindingResolutionCache: WeakMap<
+    t.Identifier,
+    LocalCallableResolution
+  >;
   readonly parameterBindingCache: Map<
     string,
     readonly JavaScriptSemanticBindingState[]
@@ -79,7 +82,7 @@ export const collectJavaScriptSemanticCalls = (
     state,
     callableById,
     output,
-    bindingResolutionCache: new Map(),
+    bindingResolutionCache: new WeakMap(),
     parameterBindingCache: new Map(),
     ancestors: [],
   };
@@ -127,7 +130,7 @@ const collectCallSite = (
     node: node.callee,
     state,
     callableById,
-    seenBindings: new Set(),
+    seenInitializers: new Set(),
     bindingCache: context.bindingResolutionCache,
   });
   const callSiteId = semanticCallSiteId(node);