feat: wire TypeScript and JavaScript universal candidates

[forhappy]

Summary

Route TypeScript and JavaScript production extraction through the registered
universal semantic candidate. Compass now uses one deterministic source-backed
path for normal builds and qualification fixtures, so universal evidence is
available to users instead of being qualification-only.

What changed

• Registered compass.typescript.candidate and compass.javascript.candidate
  as the production universal adapters, with TSX canonicalized to TypeScript.
• Emit source-anchored declarations, definitions, imports, re-exports,
  references, calls, constructions, heritage, aliases, members, JSX values,
  decorators, resources, and type-query evidence with explicit provenance.
• Wire project-wide TypeScript/JavaScript inventory and resolution for local
  modules, package conditions, aliases, re-exports, callable values, and
  framework route targets while preserving ambiguity and unresolved states.
• Preserve framework-owned convention nodes and source locations through
  universal merging, including Express/Next/Fastify/Hono/Remix-style routes.
• Keep graph identities, relationship direction, multiplicity, source ranges,
  cache reuse, and deterministic publication stable across clean, warm, rebuilt,
  restored, and alternate-checkout builds.
• Update the universal evidence reference, language architecture, managed
  analyzer guidance, qualification manifest, and changelog.

Impact

Compass no longer falls back to the legacy JavaScript/TypeScript extractor for
production graph generation. Cross-file and framework-aware graph quality now
comes from the same universal candidate that is independently qualified, with
fail-closed handling for ambiguous or unsupported bindings.

Validation

• cargo fmt --all -- --check
• cargo test --workspace --lib --bins --locked
• cargo clippy --workspace --lib --bins --locked -- -D warnings
• cargo test -p compass-languages --test typescript_universal_candidate --locked
• cargo test -p compass-resolve --test typescript_routes --locked
• sh scripts/check_product_boundary.sh
• CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-6923-inline ./scripts/qualify_code_graph_v1.sh --fixtures-only

Qualification passed with 57 languages, 1,041 coverage records, 1,773
invariants, 27 exact framework flows, and byte-identical clean/warm/rebuild/
restored/alternate outputs. Graph digest:
sha256:26a8e78a4c340627ccecc80042d21c9caed54604133c555bb5e4763a891da6c4.

This remains a draft PR for review of the production hard cut.