fix(javascript)!: preserve property paths and uncertain slot presence

Use one explicit object/array slot model and JSON-pointer property identity across mutation analysis, return projection, and semantic graphs. Require observed presence for discriminants and resolve writes only through retained object or array receivers.

BREAKING CHANGE: projected return fields require explicit presence and semantic object operations carry full property paths.

src/domain/javascript/javascriptSemanticIr.ts

@@ -380,7 +380,7 @@ export interface JavaScriptSemanticObjectOperation {
   readonly ownerCallableId: string | null;
   readonly objectBindingId: string | null;
   readonly targetBindingId: string | null;
-  readonly propertyName: string | null;
+  readonly propertyPath: readonly string[] | null;
   readonly resolution: "complete" | "partial";
 }