feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds

scripts/fixtures/generate-mitmproxy-capture.py

@@ -30,31 +30,31 @@ class Generator:
             assert "payload must not enter diagnostics" not in json.dumps(reply)
         for state, expected in [({"metadata": {1: b"bad-key"}}, "format"), ({"metadata": object()}, "decoder")]:
             try:
-                adapter.project_record(state, [])
+                adapter.project_record(state, [], 64)
             except adapter.CaptureFailure as error:
                 assert error.reason == expected, (error.reason, expected)
                 assert error.pointer == "/metadata", error.pointer
             else:
                 raise AssertionError("Invalid native representation was accepted")
-        non_utf8 = adapter.project_record({"request": {"headers": [(b"Referer", b"https://byte-user:byte-secret@example.test/path\xff")] }}, [])
+        non_utf8 = adapter.project_record({"request": {"headers": [(b"Referer", b"https://byte-user:byte-secret@example.test/path\xff")] }}, [], 64)
         assert non_utf8["reported"]["request"]["headers"][0][1] is None, non_utf8
         assert non_utf8["binary_fields"][-1]["state"] == "redacted", non_utf8
         for value in [" \tHTTPS://ows-user:ows-secret@example.test/path\t ", b" \tHTTPS://ows-user:ows-secret@example.test/path\t "]:
-            projected = adapter.project_record({"request": {"headers": [(b"Referer", value)]}}, [])
+            projected = adapter.project_record({"request": {"headers": [(b"Referer", value)]}}, [], 64)
             assert projected["reported"]["request"]["headers"][0][1] == " \tHTTPS://example.test/path\t ", projected
             assert "ows-secret" not in json.dumps(projected), projected
             if isinstance(value, bytes):
                 assert projected["binary_fields"][-1]["state"] == "redacted", projected
         body = b"A" * 12345
         state = {"response": {"content": body}}
-        control = adapter.project_record(state, [])
+        control = adapter.project_record(state, [], 64)
         field = control["binary_fields"][0]
         assert field["state"] == "retained" and field["bytes"] == len(body), control
         for literal in ["12345", "2345"]:
             # Only the generated byte count matches this exclusion.
             assert literal not in control["reported"]["response"]["content"]
             assert literal not in field["content_base64"] and literal not in field["sha256"]
-            projected = adapter.project_record(state, [literal])
+            projected = adapter.project_record(state, [literal], 64)
             assert projected["reported"]["response"]["content"] is None, projected
             assert projected["binary_fields"] == [{"pointer": "/response/content", "representation": "producer-bytes", "state": "redacted", "content_base64": None, "bytes": None, "sha256": None}], projected
             assert {"pointer": "/response/content", "reason": "explicit-sensitive-value"} in projected["redactions"], projected