fix(ts): discover static JavaScript require dependency graphs

Prerequisite under #541 and tracker #416. Program closure discovery currently walks only root import/export declarations; TypeScript6.0.3 and native7.0.2 also collect nested static require("specifier") calls in JavaScript. An entry-only JS project can therefore omit its actual CommonJS owner and every transitive dependency, so no correct source-owned type transfer or diagnostic coverage is possible. Implement HIR-based static require discovery across nested syntax, following the same literal-one-argument shape as the pinned compilers. Ignore dynamic, property-access, comment and string decoys. Preserve cycles/diamonds as unique current edges, root order and include reasons; do not scan source text or auto-add all files. Add valid/invalid entry-only and all-file controls and retain failures before measuring. This is a necessary graph foundation for #541, not a claim that CommonJS instance types are fixed.

Landed on main in three small commits: 0ebdba7 adds the audit, eaf86ee implements HIR-based static JavaScript require graph discovery, and 403385095 publishes the results. Frozen baseline: TS 6.0.3 44/44, native TS 7.0.2 44/44, Home 38/44. Immutable after candidate 31679b8aeb0a6279880dbdd140e25fd891a07e7967a36e92324f82b3776df5e7: all three compilers 44/44, or 132/132 compiler checks. The six corrected Home cases are exactly the entry-only followed graph controls; all five decoy families remain excluded. Program 143/143, Python harness 78/78, checker, driver, CLI and conformance targets pass. Results are documented in the README correctness table and docs/docs/TS_PERFORMANCE.md under Static CommonJS dependency discovery. This is untimed and does not claim #541 is fixed: its audit was rerun and Home remains 22/66 while both pinned TypeScript compilers remain 66/66.