feat(analysis): make resource budgets recoverable across CLI and MCP (#9706)

* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds

src/application/javascript/JavaScriptApplicationService.ts

@@ -3,6 +3,7 @@ import {
   ASAR_HEADER_ADMISSION_SETTING,
   parseAsarHeaderAdmission,
 } from "../../config/asarHeaderAdmission.js";
+import { parseAsarListingAdmission } from "../../config/asarListingAdmission.js";
 import { z } from "zod";
 
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
@@ -69,12 +70,22 @@ export const analyzeJavaScriptApplicationValidated = async (
     options.environment?.[ASAR_HEADER_ADMISSION_SETTING],
   );
   if (!asarHeaderAdmission.ok) return asarHeaderAdmission;
+  const listingAdmission = parseAsarListingAdmission(
+    options.environment?.REA_ASAR_MAX_LISTING_BYTES,
+  );
+  if (!listingAdmission.ok) return listingAdmission;
   const overrides = options.settings?.().overrides;
   const header = overrides?.["asar.max_header_bytes"];
-  const acceptedAdmission =
-    header === undefined
+  const listing = overrides?.["asar.max_listing_bytes"];
+  const acceptedAdmission = {
+    ...(header === undefined
       ? asarHeaderAdmission.value
-      : { maximumBytes: header, source: "runtime" as const };
+      : { maximumBytes: header, source: "runtime" as const }),
+    listing:
+      listing === undefined
+        ? listingAdmission.value
+        : { maximumBytes: listing, source: "runtime" as const },
+  };
   let reconstructed: JavaScriptArtifactReconstructionResult | undefined;
   let result: JavaScriptApplicationAnalysisResult | undefined;
   let evidence: Evidence | undefined;