fix: bind identity and coverage to the producing rule (#1513)

* fix: bind identity and coverage to the producing rule

Logical paths, container families, examined bytes, path-segment conventions, destination collisions, file-id leases, Mach-O CPU selection, and firmware cleanup now follow the observation that owns each rule.

* fix: fail unmatched Mach-O slices and keep firmware roots independent

A fat target whose architecture lipo did not list now stops before slice tools run. Chained fixups still count unread LC_DYLD_INFO rebase bytes, and a firmware cleanup failure no longer blocks the next workspace.

* test: cover path identity and runtime families at the projection boundary

NFC joins and segment conventions are now asserted by the path resolver, the Apple projection, and a real APK inventory instead of helper unit tests.

* test: expect unread dyld rebase bytes in the Apple dispatch fixture

The legacy LC_DYLD_INFO fixture keeps a rebase range this reader does not decode, so the public CLI and MCP check now requires that partial coverage beside the bind opcodes.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

src/application/javascript/JavaScriptArtifactPathResolution.test.ts

@@ -67,6 +67,36 @@ describe("artifact-local graph identity", () => {
   });
 });
 
+describe("logical path identity", () => {
+  it("resolves an NFD relative import to the NFC inventory path and rejects a root escape", () => {
+    const nfc = "caf\u00e9".normalize("NFC");
+    const nfd = nfc.normalize("NFD");
+    const files = fileMap([
+      file("dir/index.js", "root"),
+      file(`dir/${nfc}.js`, "root"),
+    ]);
+    expect(
+      resolve({
+        declaredPath: `./${nfd}.js`,
+        sourcePath: "dir/index.js",
+        context: "module-specifier",
+        files,
+      }),
+    ).toMatchObject({
+      resolution_status: "resolved",
+      resolved_path: `dir/${nfc}.js`,
+    });
+    expect(
+      resolve({
+        declaredPath: "../escape.js",
+        sourcePath: "index.js",
+        context: "module-specifier",
+        files,
+      }),
+    ).toMatchObject({ resolution_status: "rejected", resolved_path: null });
+  });
+});
+
 describe("contextual JavaScript artifact path resolution", () => {
   it.each([
     ["main.js", "app/main.js"],