feat(javascript): analyze selected application sources

Analyze exact selected sources in first-request order before unrelated
static scopes, preserving full artifact identity and byte verification.
Retain selection in CLI/MCP Evidence and summaries, with explicit unknowns
and partial coverage for unselected sources. Keep default full analysis.

Fixes #1848

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

src/domain/javascript/javascriptArtifactFiles.ts

@@ -1,3 +1,5 @@
+import type { JavaScriptSourceSelection } from "./javascriptSourceSelection.js";
+
 /** Relevant file categories projected from the complete artifact inventory. */
 export type JavaScriptArtifactFileKind =
   | "package-json"
@@ -20,7 +22,10 @@ export interface JavaScriptArtifactFile {
     | { readonly included: true; readonly value: string }
     | {
         readonly included: false;
-        readonly reason: "not-applicable" | "invalid-utf8";
+        readonly reason:
+          | "not-applicable"
+          | "invalid-utf8"
+          | "outside-analysis-scope";
       };
 }
 
@@ -38,4 +43,5 @@ export interface JavaScriptArtifactFileSet {
   readonly containers: readonly JavaScriptArtifactContainer[];
   readonly text_bytes_read: number;
   readonly invalid_utf8_files: number;
+  readonly source_selection?: JavaScriptSourceSelection;
 }