fix: retain runtime coverage for Semgrep TypeScript parse failures

[leemour]

Pinned Semgrep can fail to parse entire modern TypeScript files. Preserve the original report, compile only those failed files with pinned esbuild, and scan their runtime JavaScript with source maps back to the original source. Compilation, parser errors or missing runtime coverage still fail the run; type-only syntax remains an explicit limitation.

Run scanners independently and keep Stop hooks disabled during continuation work. Validation: full lint, typecheck, coverage (100% lines), docs and Bun smoke passed; regression cases cover finding mapping, compiler/parser failures, missing coverage and outside-root paths. An archived public messaging snapshot recovered four full-file parser failures while retaining partial-parser warnings.