fix(analysis): preserve producer identity and partial evidence

Reconcile Mach-O UUID observations without hiding malformed or conflicting sources. Require source-map identity digests to be supported by consistent observations. Keep truncated Android manifests as partial raw evidence, validate WABT section framing, and reject missing JEB inventories or error-marked success replies.

Consolidate native UUID parsing and simplify capacity and malformed-input fixtures. Focused source and public workflow checks pass, including native arm64e inspection and real WABT framing probes; a successful real JEB GUI project opening remains unverified.

src/domain/javascript/sourceToBundleComparison.test.ts

@@ -159,7 +159,8 @@ describe("source to bundle digest changes", () => {
             "dist/main.js.map",
           ),
           properties: {
-            source_sha256: HASH.unchanged,
+            content_available: true,
+            content_sha256: HASH.unchanged,
             source: "src/removed.ts",
           },
           evidence: artifactEvidence(HASH.artifact, "dist/main.js.map"),