FPFNFIXAPEX: recognize fixed imported JSON ordinal lists - #2321

Imported JSON lists can keep a fixed item-to-position mapping for a component’s lifetime and still receive no-array-index-as-key warnings. This PR recognizes a bounded ownership path through a private React 16 state cell and Route props to native ordinal text.

The supported proof now covers:

• Genuine zero-attribute Fragments, native state-key-count mount gates, a fixed string BrowserRouter basename, and private request helpers receiving a fresh flat literal options object.
• A preceding local const string may supply the URL of the proven native .get request. The allowance is tied to that exact argument, call, module, declaration and scope, with one closed read; module URLs, aliases, let/var URLs and unrelated calls remain outside it.
• Up to 12 ordered inert prelude declarations. Initialized local let bindings require exact declaration, scope and unique-binding evidence, closed reads, and an initializer proven before its capability becomes available. That capability reaches only the validated request path.
• Exhaustive strict numeric HTTP-status forwarding of the same response data, plus native rejection forwarding through a direct binding, an inline arrow, or a single-use executor-local const arrow. Arrow blocks contain one expression or return.
• Omitted or literal text responseType for exact selected Axios 0.17.1, 0.18.0 or 0.21.1 evidence under the conservative npm/Yarn manifest profile. Replacements, pnpm metadata, visible patches and unsupported manager declarations refuse this allowance. Every final record must qualify; the new default/text path admits at most 12 normalized records. Existing explicit-JSON behavior is preserved.
• RegExp and BigInt syntax refusal even when an older parser host gives a RegExp literal a null value.

Warnings remain for writes, escapes, competing producers, unstable Hook order, ambiguous sources/config, unproved control flow, var preludes, let catch handlers, shared/module callbacks, logging and recovery. The transport proof establishes an incoming ownership domain; it does not promise successful parsing or an array shape. Existing CSS/LESS competition, Windows paths, authoritative current-file bindings and per-Program invalidation remain covered.

This head includes the lexical-binding prerequisite from #2322 and Windows CI timeout from #2324. It reuses work checks from #2171 and #2167 and bounds child processes in the ordinary three-scan CLI tests. Review the combined tree or land the prerequisites first. Package versions remain 0.9.21; this follow-up changes no versions, lockfiles or workflows.

Validation on b3d9edff19b7981727b69b284a4b68cff3df1c20:

• Forced workspace tests: 36,437 passed, 1,119 skipped across seven packages; all 12 test/build tasks executed with zero cache hits.
• Forced typecheck and build: 10 and 5 successful tasks, respectively, with zero cache hits.
• Focused provider and whole-rule snapshot suites: 569 and 380 passed.
• Repository lint, formatting, JSON-report smoke and published-dependency checks passed. Existing lint warnings remain.
• Independent static review accepted the three-file local-URL delta and the two added refusal controls. Earlier source retains its review qualifications. There were no unexpected failures or retries; the initial provider pass and the requested test-only control revision are recorded separately.

All seven platform jobs, lint, typecheck and both automatic preview builds passed. GitHub CI tested merge f0efc1e76576297aadf8f2a55cd24191a9aa8e43 with main ad51b5a6b1a67106fce8015439f868940cc884f4 (tree 420c91ebcceaafce1a7ed386bbaf60873c830141); local validation above tested head tree 2dc7ed63cc63d7c69eb328f5556b394b25468bd7. Their totals are recorded separately. This PR's 69 compared files have identical Git blobs in those trees; 22 additional main paths account for the tree difference. The PR preview built the merge, while the push preview built the head. Fixed manifest reads verified three 0.9.21 versions and the matching Oxlint preview dependency URLs; archive code identity was not checked. Whole-corpus parity was waived by the requester.