fix(artifacts): carry recorded integrity contradictions into application workflows

A recorded contradiction appeared only in the analyze_javascript_application
response. Version and source comparisons, feature traces, and export-shape
comparisons read the application graph, which still claimed complete
coverage, so they could report complete-within-inputs results over
untrusted bytes. The graph is now partial when contradictions were
recorded, and its limitations, inherited by the result and the semantic
graph, name every contradicted path.

The mismatch remediation names both spellings: integrity_policy in MCP
and --integrity-policy on the CLI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/application/javascript/JavaScriptArtifactReconstruction.ts

@@ -12,7 +12,10 @@ import type { ElectronBoundarySummary } from "../../domain/javascriptApplication
 import type { IntegrityContradiction } from "../../domain/artifactGraph.js";
 import { analyzeJavaScriptArtifactFiles } from "./JavaScriptArtifactAnalysis.js";
 import { readJavaScriptArtifactFiles } from "./JavaScriptArtifactFiles.js";
-import { buildJavaScriptArtifactGraph } from "./JavaScriptArtifactGraphBuilder.js";
+import {
+  buildJavaScriptArtifactGraph,
+  integrityContradictionLimitations,
+} from "./JavaScriptArtifactGraphBuilder.js";
 import {
   javascriptArtifactReconstructionInputSchema,
   type JavaScriptArtifactReconstructionInput,
@@ -75,6 +78,7 @@ export const reconstructJavaScriptArtifact = async (
       rootArtifactSha256: snapshot.manifest.root_sha256,
       applicationGraph: graph,
       analysis,
+      sourceLimitations: integrityContradictionLimitations(snapshot),
     });
     return {
       input_path: path,