Make state-access analysis binding-aware

[smiggleworth]

Summary

Closes #125 and supports askrjs/askr#372.

The analyzer now follows TypeScript symbol identity for state getter and setter bindings across all six state-sensitive rules. This removes cross-scope shadowing false positives without hiding genuine state reads, render writes, reactive mapping, missing dependencies, row-closure captures, or effect-based data loading. Symbol-keyed ownership also preserves same-named state declared by sibling components.

The existing state-access work remains intact: renamed destructuring, deliberate accessor forwarding, and the actual imported watch() source binding are recognized without suppressing genuine uncalled-getter diagnostics or same-named local calls.

Release and compatibility

• @askrjs/cli: 0.2.2 to 0.2.3
• js-yaml: 5.4.0 to 5.4.1
• Validated package set: @askrjs/askr@0.2.4, @askrjs/ui@0.2.4, @askrjs/themes@0.2.5, @askrjs/server@0.2.2, @askrjs/node@0.2.2, @askrjs/charts@0.2.2, and @askrjs/vite@0.2.2
• oxc-parser@0.147.0 is the transitive parser required by the validated @askrjs/vite@0.2.2; it is not a new direct dependency.
• @types/node remains on 26.3.x by policy; no security work, peer-range widening, unpublished aliases, or compatibility workarounds are included.

No public CLI API changes. Diagnostics keep their existing rule IDs, severity, and error surfaces; only binding ownership becomes symbol-accurate.

Validation

• Clean npm ci: 216 packages, 0 vulnerabilities
• Focused analyzer class regressions: passed three times, including the complete suite run
• npm run check: 20 files, 274 tests; coverage, changelog, typecheck, lint, build, docs, publint, and package dry-run all passed
• npm run test:templates: passed
• npm run test:peer-floor: passed
• npm run bench: all analysis and CLI p95 budgets passed
• Package dry-run: 253 files; candidate integrity sha512-UZHf9c0eY7UjGuGR9ocPtsTaDlOX5oLcfomS9jXVUZkgSTBbIfO9BEPiQkX5ljSq0MVndiK94cxtIUKPANViPQ==
• npm outdated: only the intentionally excluded @types/node@26.4.0

Review closure

The complete main...head diff was reviewed before and after feedback remediation. The inline and general feedback about partial name-only matching is fixed by the class-level regressions and answered with concrete validation evidence; the review thread is resolved. The second pass also found and closed a same-named local watch shadowing seam with an adversarial regression.

[smiggleworth]

Follow-up on the inline finding: the symbol-identity check that closes the cross-scope shadowing false-positive is only applied in `stateAccessRule` and `stateRenderWriteRule`. `preferForRule`, `exhaustiveDependenciesRule`, `forRowClosureCaptureRule`, and `noEffectDataLoadingRule` all call `collectStateBindings(...).getters` and match by name only, so they're exposed to the same shadowing bug this PR fixes. Recommend extending the fix to all six call sites (or centralizing the identity check in `collectStateBindings`) before merging, rather than landing a partial fix.

[smiggleworth]

The follow-up is fully addressed by 195cf6a: all six state-sensitive analyzer rules now resolve the actual TypeScript accessor symbol, and symbol-keyed owner and snapshot maps preserve same-named sibling bindings. The shadowing class regression covers state-access, state-render-write, prefer-for, exhaustive-dependencies, for-row-closure-capture, and no-effect-data-loading together; the positive sibling regression confirms genuine same-named state writes are still reported. Local validation passed npm run check with 273 tests, template integration, peer-floor integration, and every performance budget.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.