fix(browser): preserve passive network inventory uncertainty

Preserve uncertainty in offline passive network comparisons when request
identity, metadata, or per-kind inventory coverage is incomplete. Retain
proven HTTP/WebSocket changes without using missing information to infer
membership, duplicate counts, or equality.

Compare redirect resource types only where both observations retain them.
Keep metadata completeness with its owner, stream HTTP content digests,
and require full coverage for multiplicity and WebSocket stream inventories.
Preserve independently known metadata changes and full-inventory counts.

Keep the original JavaScript configuration-escape, JSON, cancellation,
SAZ and schema-documentation fixes compatible with current main. Split
public CLI comparisons into isolated test cases without loosening timeouts.
Validate actual Chromium/HTTP captures through CLI and real stdio SDK,
with explicit limits and unchanged source bytes.

Co-authored-by: To3akaRin <131595336+To3akaRin@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/domain/javascript/javascriptSemanticAnalysis.native_bindings.test.ts

@@ -225,6 +225,29 @@ describe("JavaScript semantic analysis: configuration value escapes", () => {
     expect(configurationReads(body)).toEqual([[kind, key]]);
   });
 
+  it.each([
+    "patch(process.argv[key]); return process.argv[3];",
+    "patch(process.argv.__proto__); return process.argv[3];",
+    "const args = process.argv; patch(args[key]); return args[3];",
+  ])(
+    "retains uncertainty after an object-valued argv selection escapes: %s",
+    (body) => {
+      expect(configurationReads(body)).not.toContainEqual(["argv", "3"]);
+    },
+  );
+
+  it("preserves an earlier top-level read and unrelated configuration after an argv escape", () => {
+    const captured = analyzeJavaScriptSemantics(
+      "const saved = process.argv[3]; patch(process.argv[key]); globalThis.saved = saved;",
+    );
+    expect(
+      captured.configurationOperations.map(({ kind, key }) => [kind, key]),
+    ).toContainEqual(["argv", "3"]);
+    expect(
+      configurationReads("patch(process.argv[key]); return process.env.PORT;"),
+    ).toContainEqual(["environment", "PORT"]);
+  });
+
   it.each([
     [
       "a direct argv entry",