fix(evidence): preserve subjects in derived workflows (#9492)

* fix(javascript): preserve verified trace evidence subjects

Co-authored-by: Felix <3937061056@qq.com>

* fix(evidence): preserve selected subject names in views

* fix(evidence): preserve subjects across related workflows

* fix(evidence): retain inventory projection subjects

* fix(managed): validate projected graph root identity

* style: format evidence and native command code

* fix(javascript): validate static graph root identity

* test(javascript): update feature trace graph expectations

---------

Co-authored-by: Felix <3937061056@qq.com>

src/domain/javascript/javascriptApplicationAnalysis.ts

@@ -132,6 +132,27 @@ function* checkApplicationBindingsSteps(
   try {
     for (const node of result.graph.nodes) {
       applicationNodeIds.add(node.node_id);
+      if (
+        node.kind === "artifact" &&
+        (node.identity.strategy !== "content-digest" ||
+          node.identity.sha256 !== result.root_artifact_sha256)
+      ) {
+        for (const observation of node.observations) {
+          if (observation.evidence.extractor.operation === "inventory-root") {
+            context.addIssue({
+              code: "custom",
+              path: ["root_artifact_sha256"],
+              message:
+                "Application artifact root must match the declared root SHA-256",
+            });
+            break;
+          }
+          if (++examined === 4096) {
+            examined = 0;
+            yield;
+          }
+        }
+      }
       if (++examined === 4096) {
         examined = 0;
         yield;