feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds

scripts/verify-windows-native.mjs

@@ -543,10 +543,12 @@ process.stdout.write(JSON.stringify({executable:basename(process.execPath),abiVe
       "readback-",
     );
     try {
-      readbackRuntime.writeFile("written.txt", "runtime-write-readback");
+      const written = "runtime-write-readback";
+      const sourceBytes = await readFile(source);
+      readbackRuntime.writeFile("written.txt", written);
       assert.equal(
-        readbackRuntime.readFile("written.txt"),
-        "runtime-write-readback",
+        readbackRuntime.readFile("written.txt", Buffer.byteLength(written)),
+        written,
       );
       const readbackSnapshot = await readbackRuntime.snapshot(
         source,
@@ -554,21 +556,19 @@ process.stdout.write(JSON.stringify({executable:basename(process.execPath),abiVe
       );
       assert.equal(
         readbackSnapshot.sha256,
-        createHash("sha256")
-          .update(await readFile(source))
-          .digest("hex"),
+        createHash("sha256").update(sourceBytes).digest("hex"),
       );
       assert.equal(
-        readbackRuntime.readFile("snapshot.bin"),
-        await readFile(source, "utf8"),
+        readbackRuntime.readFile("snapshot.bin", sourceBytes.byteLength),
+        sourceBytes.toString("utf8"),
       );
       const writtenPath = join(readbackRuntime.observation.path, "written.txt");
       await assert.rejects(writeFile(writtenPath, "replace"));
       await assert.rejects(rename(writtenPath, `${writtenPath}.renamed`));
       await assert.rejects(rm(writtenPath));
       assert.equal(
-        readbackRuntime.readFile("written.txt"),
-        "runtime-write-readback",
+        readbackRuntime.readFile("written.txt", Buffer.byteLength(written)),
+        written,
       );
       const snapshotPath = join(
         readbackRuntime.observation.path,
@@ -590,8 +590,8 @@ process.stdout.write(JSON.stringify({executable:basename(process.execPath),abiVe
       await assert.rejects(rename(snapshotPath, `${snapshotPath}.renamed`));
       await assert.rejects(rm(snapshotPath));
       assert.equal(
-        readbackRuntime.readFile("snapshot.bin"),
-        await readFile(source, "utf8"),
+        readbackRuntime.readFile("snapshot.bin", sourceBytes.byteLength),
+        sourceBytes.toString("utf8"),
       );
       report.controls = {
         ...report.controls,
@@ -622,7 +622,11 @@ process.stdout.write(JSON.stringify({executable:basename(process.execPath),abiVe
       assert.equal(await exists(heldPath), true);
       assert.throws(
         () => retryRuntime.writeFile("after-close.txt", "forbidden"),
-        /cleanup is in progress or complete/u,
+        /Windows private runtime cleanup is in progress or complete/u,
+      );
+      assert.equal(
+        await exists(join(retryRuntime.observation.path, "after-close.txt")),
+        false,
       );
       holder.child.stdin.end("\n");
       const [exitCode] = await holder.closed;