fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/electronStaticAnalysisValues.ts

@@ -18,10 +18,25 @@ export const electronCalleePath = (
   const { root, members } = electronMemberPath(callee);
   if (!members.every((member): member is string => member !== null))
     return undefined;
-  const exported = context.electronBindings?.get(root.start ?? -1);
+  const exported =
+    context.electronBindings?.get(root.start ?? -1) ??
+    context.electronCandidateBindings?.get(root.start ?? -1);
   return exported === undefined ? undefined : [...exported, ...members];
 };
 
+/** Keep the identity uncertainty attached to each derived finding. */
+export const electronCandidateAuthority = (
+  callee: t.Node,
+  context: JavaScriptFindingContext,
+): { readonly loader_authority?: "candidate" } => {
+  const { root } = electronMemberPath(callee);
+  const offset = root.start ?? -1;
+  return context.electronBindings?.has(offset) !== true &&
+    context.electronCandidateBindings?.has(offset) === true
+    ? { loader_authority: "candidate" }
+    : {};
+};
+
 /** Preserve one literal value or the exact inert expression. */
 export const electronStaticValue = (
   source: string,