feat(browser): trace captured website source-map locations (#897)

* refactor(browser): share captured-script acquisition boundaries

Reuse stable capture/source acquisition and identity validation for module
and source-map analysis. Preserve host I/O, malformed input, unavailable
source and digest mismatch diagnostics.

Refs #851

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* feat(browser): trace captured website source-map locations

Refs #851. Preserve selected capture/map byte identity, duplicate mappings and embedded source evidence through the pinned upstream codec.

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* test(browser): verify source-map artifacts and synchronize generated contracts

Cover byte-preserving map reads and actionable filesystem constraints. Refresh generated public schemas and metadata on current main.

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(browser): preserve inert source-map URL context

The selected URL is local codec context and grants no transport authority. Preserve its reported text and verify normal/userinfo contexts through real public interfaces, alongside independent manifest byte identity.

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

src/javascript/sourceMaps/SourceMapCodecProtocol.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import {
+  webSourceMapReportSchema,
+  webSourcePositionSchema,
+} from "../../domain/webSourceLocation.js";
+
+/** Trusted codec process input; captured application code is never evaluated. */
+export const sourceMapCodecInputSchema = z.strictObject({
+  text: z.string(),
+  url: z.string().min(1),
+  position: webSourcePositionSchema,
+});
+
+/** Codec success or a specific producer/resource constraint. */
+export const sourceMapCodecReplySchema = z.discriminatedUnion("state", [
+  z.strictObject({
+    state: z.literal("success"),
+    report: webSourceMapReportSchema,
+  }),
+  z.strictObject({
+    state: z.literal("failure"),
+    reason: z.enum(["format", "unsupported", "limit"]),
+    message: z.string(),
+  }),
+]);