feat(javascript): analyze selected application sources

Analyze exact selected sources in first-request order before unrelated
static scopes, preserving full artifact identity and byte verification.
Retain selection in CLI/MCP Evidence and summaries, with explicit unknowns
and partial coverage for unselected sources. Keep default full analysis.

Fixes #1848

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

src/domain/javascript/javascriptApplicationAnalysis.ts

@@ -16,6 +16,10 @@ import { integrityContradictionSchema } from "../artifactGraph.js";
 import { artifactIntegrityPolicySchema } from "../artifactIntegrityPolicy.js";
 import { localPathStringSchema } from "../localPath.js";
 import { javaScriptAnalysisResourceControlsSchema } from "./javascriptAnalysisResourceControls.js";
+import {
+  javaScriptSourcePathsSchema,
+  javaScriptSourceSelectionSchema,
+} from "./javascriptSourceSelection.js";
 
 const countSchema = z.number().int().min(0);
 
@@ -24,6 +28,7 @@ export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
   input_path: localPathStringSchema,
   format: z.enum(["auto", "asar", "directory"]).default("auto"),
   integrity_policy: artifactIntegrityPolicySchema,
+  source_paths: javaScriptSourcePathsSchema.optional(),
   ...javaScriptAnalysisResourceControlsSchema.shape,
 });
 
@@ -71,6 +76,7 @@ const applicationAnalysisResultShape = z.strictObject({
   inventory_manifest_id: prefixedDigestSchema("agm"),
   inventory_graph_sha256: digestSchema,
   integrity_contradictions: z.array(integrityContradictionSchema),
+  source_selection: javaScriptSourceSelectionSchema.exactOptional(),
   graph: javascriptApplicationGraphSchema,
   summary: electronBoundarySummarySchema,
   statistics: reconstructionStatisticsSchema,