fix(javascript): preserve original BOM source coordinates (#1093)

* test(javascript): reproduce BOM source range drift

Compare original UTF-8 source bytes and their retained digests with direct Babel and parse5 source-location oracles through actual directory and ASAR artifact reconstruction and both built public CLI analysis commands. Preserve no-BOM, structured-BOM and invalid UTF-8 controls. Tests only; production and workflows unchanged.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(javascript): preserve original BOM source coordinates

Retain the initial UTF-8 BOM for JavaScript and HTML source text so graph ranges refer to the original digest-bound bytes. Preserve structured-text BOM handling and fatal UTF-8 decoding.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* style(javascript): format BOM decoder option

Apply the locked Oxfmt line wrapping to the approved decoder option; no behavior or test changes.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

src/artifacts/javascript/JavaScriptArtifactFiles.ts

@@ -222,7 +222,12 @@ const readText = async (
   try {
     return {
       included: true,
-      value: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+      value: new TextDecoder("utf-8", {
+        fatal: true,
+        ignoreBOM:
+          input.expected.kind === "javascript" ||
+          input.expected.kind === "html",
+      }).decode(bytes),
     };
   } catch (cause: unknown) {
     // Non-UTF8 bytes are counted; the fixed reason preserves the schema.