fix(javascript): invalidate stale facts across direct eval

Index unshadowed direct-eval sites once at the semantic owner. Distinguish
lexical rebinding, non-strict eval-introduced names, and possible mutation
of reachable objects. Reuse existing effect timing and capture proofs;
retain original definitions and module origins without inventing assignments
or parsing or executing eval payloads. Query object uncertainty conservatively
across the owning activation so aliases remain covered when names are shadowed
or leave block scope. Retain no binding-by-eval table.

Use the shared facts for values, read provenance, reference effects and child
argument shapes. Preserve indirect/optional/shadowed eval controls, unrelated
activations, immutable shapes, strict-mode bindings and prior primitive
captures. Remove obsolete reference plumbing and the source-wide eval blocker.

Validation: 306 focused checks across 16 files pass, including compiled CLI
and stdio MCP return projections, constructor uncertainty and child-process
consumers. Against the preceding SQLite commit, 9 of 23 selected checks fail
and 14 controls pass. Static/docs/test discovery (1559 files) pass. Two source
reviews found no remaining scoped blocker after alias and sloppy-name fixes.
No analyzed JavaScript, SQLite engine, heavy test or profiler was executed.
Conservative object reachability can intentionally lose exactness; large-case
opaque-query CPU and memory remain unmeasured.

Fixes #4875

src/domain/javascript/javascriptSemanticExpressionShapes.ts

@@ -1,3 +1,7 @@
+import {
+  semanticOpaqueBindingReadMayHaveChanged,
+  semanticOpaqueNameMayHaveChanged,
+} from "./javascriptSemanticOpaqueEffects.js";
 import * as t from "@babel/types";
 
 import {
@@ -9,7 +13,6 @@ import {
   isUnmodeledJavaScriptRuntimeScope,
 } from "./javascriptModuleDeclaration.js";
 import { semanticBindingAtRead } from "./javascriptSemanticMutationInitializers.js";
-import type { JavaScriptSemanticReference } from "./javascriptSemanticIr.js";
 import { SEMANTIC_EXPRESSION_DEPTH_LIMIT } from "./javascriptSemanticResourceLimits.js";
 import {
   isUnshadowedGlobal,
@@ -32,7 +35,6 @@ const commonJsWrapperParameterNames = new Set([
 /** Bounded child-argument identity only; never recover named object contents. */
 export const createSemanticExpressionShapeResolver = (
   state: JavaScriptSemanticAnalysisState,
-  references: readonly JavaScriptSemanticReference[],
 ) => {
   const hoistedFunction = (node: t.Node): boolean => {
     const parent = state.parentsByNode.get(node);
@@ -49,22 +51,21 @@ export const createSemanticExpressionShapeResolver = (
   const blockFunctionNames = new Set<string>();
   const namedProofBlocked = (): boolean => {
     if (blocked !== undefined) return blocked;
-    blocked = references.some(({ name }) => name === "eval");
-    if (!blocked)
-      traverseJavaScriptAst(state.program, {
-        enter(node) {
-          blocked ||=
-            isErasedJavaScriptDeclaration(node) ||
-            isUnmodeledJavaScriptRuntimeScope(node);
-          if (
-            javaScriptRuntimeContext(state.program) !== "module" &&
-            t.isFunctionDeclaration(node) &&
-            node.id != null &&
-            !hoistedFunction(node)
-          )
-            blockFunctionNames.add(node.id.name);
-        },
-      });
+    blocked = false;
+    traverseJavaScriptAst(state.program, {
+      enter(node) {
+        blocked ||=
+          isErasedJavaScriptDeclaration(node) ||
+          isUnmodeledJavaScriptRuntimeScope(node);
+        if (
+          javaScriptRuntimeContext(state.program) !== "module" &&
+          t.isFunctionDeclaration(node) &&
+          node.id != null &&
+          !hoistedFunction(node)
+        )
+          blockFunctionNames.add(node.id.name);
+      },
+    });
     return blocked;
   };
   const shape = (input: t.Node): Shape => {
@@ -103,6 +104,7 @@ export const createSemanticExpressionShapeResolver = (
       // assignment. Keep same-named vars unknown rather than model that copy.
       if (
         namedProofBlocked() ||
+        semanticOpaqueBindingReadMayHaveChanged(binding, node, state) ||
         (binding.declarationKinds.has("var") &&
           blockFunctionNames.has(binding.name))
       )
@@ -128,7 +130,9 @@ export const createSemanticExpressionShapeResolver = (
       const { node } = unwrapJavaScriptExpression(input);
       return (
         isNullishJavaScriptSyntax(node) ||
-        (isUnshadowedGlobal(node, state, "undefined") && !namedProofBlocked())
+        (isUnshadowedGlobal(node, state, "undefined") &&
+          !namedProofBlocked() &&
+          !semanticOpaqueNameMayHaveChanged(node, state))
       );
     },
   };