fix(javascript): bound symbolic property and member queries (#8876)

Fixes #8838.

Admit all symbolic query entry points through the existing resolver budget, preserve cache-hit depth and restore entered frames in finally. Retain independent facts with partial source coverage instead of losing entire scripts to recursive spreads.

Validated 273 focused tests, check:fast/docs:check, real CLI/stdio-MCP projections and complete parent reads, independent public-source oracle, and unchanged full results for the official Electron control and Bitwarden selected preload.

Full technical CI 42308068679 passes, including all eight shards and required aggregates. Greptile reviews this head at 5/5; no completed Codex review of this head is available. The Author readiness-only exception is explicitly authorized; no human-review attestation is added.

Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)

docs/javascript-application-graph.md

@@ -171,6 +171,13 @@ resource truncation. JavaScript summary `limitation_count` counts the full,
 deduplicated union of parent, application and semantic caveats, including messages
 whose delivery is omitted by the view's byte budget.
 
+Symbolic property reads and member enumeration share the expression resolver's
+existing resource budget, including recursive return spreads with fresh arguments.
+A bounded source retains independent window, preload and endpoint facts while
+reporting `parse_status: partial` and limited examination in `analysis_coverage`.
+Unresolved recursive values remain unknown; selected views retain source coverage
+separately from the completeness of the returned page.
+
 Unavailable values are represented explicitly rather than as missing fields,
 so absence of evidence cannot silently become evidence of absence.