fix(javascript): bind native handoffs to canonical byte identity

Require the native node owner's content digest instead of borrowing an
observation artifact digest, which can identify the containing ASAR. Keep
unavailable nodes and their path/provenance/partial facts in the trace,
without a false actionable target or native Evidence link. Remove the old
fallback and allocate the query index only for eligible native targets.

Verify real public CLI/stdio MCP workflows, known/missing companion inputs
and shipped Joplin controls. Preserve reproducible scripts, source pins and
compact correctness/resource/token records without archiving applications.

Fixes #3926. Part of #4027.

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>

docs/javascript-application-workflows.md

@@ -95,6 +95,14 @@ matches exactly. Otherwise the result recommends provider-neutral follow-up
 tools and reports `requires-provider-analysis`; it never starts or switches a
 provider implicitly.
 
+A handoff requires the add-on's exact content identity. Unavailable unpacked
+companions remain visible in the trace graph with their canonical path,
+availability and container-backed Evidence. They yield no actionable handoff
+until their bytes are available and the application is reanalyzed; the archive
+digest does not identify the missing add-on. An empty handoff list does not prove
+that the trace contains no native components. Source partial coverage remains
+visible independently of handoff eligibility.
+
 ## Semantic relation tracing
 
 `trace_javascript_semantics` queries the authenticated companion graph without