fix(evidence): preserve subjects in derived workflows (#9492)

* fix(javascript): preserve verified trace evidence subjects

Co-authored-by: Felix <3937061056@qq.com>

* fix(evidence): preserve selected subject names in views

* fix(evidence): preserve subjects across related workflows

* fix(evidence): retain inventory projection subjects

* fix(managed): validate projected graph root identity

* style: format evidence and native command code

* fix(javascript): validate static graph root identity

* test(javascript): update feature trace graph expectations

---------

Co-authored-by: Felix <3937061056@qq.com>

tests/boundary/javascript/javascriptSelectedPathEvidence.test.ts

@@ -9,7 +9,9 @@ import {
 import { join } from "node:path";
 import { expect } from "vitest";
 
-import { parseEvidence } from "../../../src/domain/evidence.js";
+import { createEvidence, parseEvidence } from "../../../src/domain/evidence.js";
+import { javascriptApplicationAnalysisResultSchema } from "../../../src/domain/javascript/javascriptApplicationAnalysis.js";
+import { createJavaScriptSemanticGraph } from "../../../src/domain/javascript/javascriptSemanticGraph.js";
 import { parseEvidenceBundle } from "../../../src/domain/evidenceBundle.js";
 import { parseApplicationGraphEvidence } from "../../../src/application/javascript/JavaScriptApplicationEvidenceGraph.js";
 import { JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE } from "../../../src/contracts/javascript/javascriptRuntimeReconciliationExample.js";
@@ -45,6 +47,40 @@ cliTest(
     });
     expect(cliResponse.exitCode, cliResponse.stderr).toBe(0);
     const cliEvidence = parseEvidence(cliResponse.json);
+    const parsed = javascriptApplicationAnalysisResultSchema.parse(
+      cliEvidence.normalized_result,
+    );
+    const { graph_id: _id, ...semantic } = parsed.semantic_graph;
+    const foreignSha = "f".repeat(64);
+    const forged = createEvidence(
+      { path: parsed.input_path, sha256: foreignSha, format: parsed.format },
+      cliEvidence.provider,
+      {
+        operation: cliEvidence.operation,
+        predicateType: cliEvidence.predicate_type,
+        parameters: cliEvidence.parameters,
+        confidence: "derived",
+        authority: "shipped-artifact",
+        result: {
+          ...parsed,
+          root_artifact_sha256: foreignSha,
+          semantic_graph: createJavaScriptSemanticGraph({
+            ...semantic,
+            root_artifact_sha256: foreignSha,
+          }),
+        },
+      },
+    );
+    expect(parseApplicationGraphEvidence(forged)).toMatchObject({
+      ok: false,
+      error: {
+        issues: expect.arrayContaining([
+          expect.objectContaining({
+            path: ["normalized_result", "root_artifact_sha256"],
+          }),
+        ]),
+      },
+    });
 
     for (const command of ["analyze", "analyze-javascript-application"]) {
       const relativeResponse = await cli.run({