feat(electron): report custom URL protocol registrations

Expose static Electron protocol call facts through the shared application graph and existing CLI/MCP Evidence views. Preserve canonical case-insensitive scheme identity, original spellings, exact source provenance and explicit unknowns; keep registration success and runtime routing unproven.

Integration fixes also enforce module-only privileged API ownership, reuse the shared finding-key owner, and align the owning type documentation with the Evidence semantics. Validation and bounded real Obsidian CLI/MCP measurements are recorded in the PR.

Co-authored-by: UnknownHacker1 <35694178+UnknownHacker1@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.ts

@@ -300,6 +300,23 @@ const electron = z
         dynamic_member_access: z.boolean().optional(),
       }),
     ),
+    protocols: z.array(
+      z
+        .strictObject({
+          ...findingContext,
+          api: z.string(),
+          role: z.enum([
+            "os-default-client",
+            "privileged-scheme",
+            "handler",
+            "interceptor",
+          ]),
+          scheme: staticValue,
+          session: z.enum(["default-protocol", "default-session"]),
+          enabled_privileges: strings.nullable(),
+        })
+        .transform(withRuntime),
+    ),
   })
   .transform(({ call_paths, app_path_changes, ...rest }) => ({
     ...rest,