feat(javascript): analyze selected application sources

Analyze exact selected sources in first-request order before unrelated
static scopes, preserving full artifact identity and byte verification.
Retain selection in CLI/MCP Evidence and summaries, with explicit unknowns
and partial coverage for unselected sources. Keep default full analysis.

Fixes #1848

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

src/application/javascript/JavaScriptApplicationEvidence.ts

@@ -91,4 +91,7 @@ const parameters = (
 ): EvidenceObservation["parameters"] => ({
   format: input.format,
   integrity_policy: input.integrity_policy,
+  ...(input.source_paths === undefined
+    ? {}
+    : { source_paths: input.source_paths }),
 });