feat(artifacts): let extraction and JavaScript analysis record integrity mismatches

macOS code signing rewrites unpacked native modules after electron-builder
records their ASAR integrity, so the declared and observed hashes of
those .node files differ in most signed Electron apps. Claude, ChatGPT,
Notion, Obsidian, and Tabby all failed inspect_artifact,
extract_artifact, and analyze_javascript_application by default. Only
inspect_artifact offered integrity_policy, so extraction and JavaScript
analysis of these apps was impossible.

extract_artifact and analyze_javascript_application now accept the same
integrity_policy (default fail). With record-and-continue, extraction
writes the observed bytes, and JavaScript analysis reads contradicted
files as observed. Contradicted nested archives stay unexpanded. Both
results return the recorded integrity_contradictions and a limitation.
The mismatch remediation now names this option instead of only advising a
fresh copy, which cannot help for a signed installation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/application/javascript/JavaScriptArtifactReconstruction.ts

@@ -9,6 +9,7 @@ import { DirectoryArtifactReader } from "../../artifacts/DirectoryArtifactReader
 import type { JavaScriptApplicationGraph } from "../../domain/javascriptApplicationGraph.js";
 import type { JavaScriptSemanticGraph } from "../../domain/javascriptSemanticGraph.js";
 import type { ElectronBoundarySummary } from "../../domain/javascriptApplicationAnalysis.js";
+import type { IntegrityContradiction } from "../../domain/artifactGraph.js";
 import { analyzeJavaScriptArtifactFiles } from "./JavaScriptArtifactAnalysis.js";
 import { readJavaScriptArtifactFiles } from "./JavaScriptArtifactFiles.js";
 import { buildJavaScriptArtifactGraph } from "./JavaScriptArtifactGraphBuilder.js";
@@ -30,6 +31,7 @@ export interface JavaScriptArtifactReconstructionResult {
   readonly graph: JavaScriptApplicationGraph;
   readonly semantic_graph: JavaScriptSemanticGraph;
   readonly electron_summary: ElectronBoundarySummary;
+  readonly integrity_contradictions: readonly IntegrityContradiction[];
   readonly statistics: {
     readonly relevant_files: number;
     readonly nested_asar_containers: number;
@@ -54,7 +56,10 @@ export const reconstructJavaScriptArtifact = async (
   abortIfNeeded(signal);
   const path = await realpath(input.input_path);
   const format = await resolveFormat(path, input);
-  const snapshot = await scanCanonicalArtifactInventory(path, { signal });
+  const snapshot = await scanCanonicalArtifactInventory(path, {
+    signal,
+    integrity: { mode: input.integrity_policy },
+  });
   if (snapshot.manifest.root_format !== format)
     throw new ArtifactReaderFailure(
       "format",
@@ -80,6 +85,7 @@ export const reconstructJavaScriptArtifact = async (
       graph,
       semantic_graph: semanticGraph,
       electron_summary: summarizeElectronBoundaries(analysis),
+      integrity_contradictions: snapshot.integrity_contradictions,
       statistics: {
         relevant_files: files.files.length,
         nested_asar_containers: files.containers.length,