[TS Calls] Evaluate fallback policies and models with concrete replay

[CaelmBleidd]

The four unknown-call configurations need comparable target measurements and concrete replay against the original TypeScript. This PR adds a dedicated usvm-ts-calls experiment module, preserves symbolic and replay outcomes separately, and stores lossless scalar witnesses so individual results can be reproduced.

The reusable property layer is split by responsibility:

• usvm-ts-pbt owns backend-neutral property/domain models, validation, registries, run and coverage contracts, Istanbul decoding, and property-to-EtsIR mapping;
• usvm-ts-fast-check owns FastCheckBackend, the Node adapter, supervised process transport, c8 collection, CLI, and packaged runtime;
• usvm-ts-calls depends on both and delegates concrete source replay to FastCheckBackend.

Calls source replay instruments a temporary source overlay and executes one constant-input property through that shared backend. Calls therefore carries no second Node adapter, transport, supervisor, npm package, or dependency lock.

The experiment supports the empty/frozen model sets crossed with STOP_PATH/FRESH_SYMBOLIC_RETURN, rotates profiles, aggregates raw results, and replays one stored witness. Reproducibility uses pinned tool, project, and native-frontend Git revisions plus selected model IDs. The manifest and results contain no catalog fingerprints or source/runtime digest metadata.

Symbolic exploration uses CLOSEST_TO_UNCOVERED_RANDOM, with stopOnCoverage = 0, so the bounded census is guided toward varied uncovered call sites without stopping after reaching a coverage threshold. Manifest validation rejects BFS to prevent silently returning to its short, early-path bias.

The symbolic engine aligns target observation with original-source replay. For statements such as throw new Error(...), EtsIR evaluates nested instructions before the exact-span EtsThrowStmt; the engine observes a uniquely proven CFG entry into the complete source-statement lowering region. Ambiguous or insufficient origin metadata is reported as unsupported.

TsMachine exposes whether analysis exhausted its paths or stopped early. The Calls experiment maps the latter to timeout because timeout is its only enabled stop condition; no shared usvm-core stop-strategy API is changed.

Validation:

• FastCheck adapter tests: 48/48;
• backend-neutral PBT checks and FastCheck backend checks: passed;
• Calls tests: 13/13, including manifest rejection of BFS;
• Detekt for usvm-ts-pbt, usvm-ts-fast-check, and usvm-ts-calls, main and test: zero findings;
• complete :usvm-ts-calls:check;
• clean installed distributions for usvm-ts-fast-check and usvm-ts-calls;
• validateProjectList: passed;
• installed one-target/four-profile replay with CLOSEST_TO_UNCOVERED_RANDOM: all four profiles reached fibonacciIterative#negative-input and replayed as confirmed;
• standalone FROZEN_STOP witness replay: confirmed target hit with the expected thrown Error.

Closes #385.