fix(javascript): retain standalone GraphQL source operations

Retain named operations in GraphQL Source bodies with locationOffset metadata.
Use final property ownership and parsed lexical facts to suppress copies only
when a recovered document, its containers and source aliases have proven
private metadata ownership. Preserve independent observations after writes,
exports, opaque uses, classic-script global exposure or direct evaluation.

Share interpretation across application and captured-web analysis. Build
optional reference indexes once per source and checkpoint examined records,
including suppressed findings, to retain cooperative cancellation.

Fixes #3311

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/domain/javascript/javascriptStaticAnalysisCalls.ts

@@ -454,6 +454,16 @@ export const inspectRpcNode = (node: t.Node, context: FindingContext): void => {
     addEndpoint(context, { node, kind: "network", ...rpc });
 };
 
+/** Resolve deferred Source bodies after their document owners have been seen. */
+export function* finishRpcScanSteps(
+  context: FindingContext,
+): Generator<void, void> {
+  for (const rpc of context.rpcScan.finish()) {
+    if (rpc !== undefined) addEndpoint(context, { kind: "network", ...rpc });
+    yield;
+  }
+}
+
 export const inspectRouteProperty = (
   node: t.ObjectProperty,
   context: FindingContext,