[TS PBT] Integrate exact c8/EtsIR edge feedback into target selection #382

Part of #345. Depends on #350. Required for exact branch feedback in the core #355/#405 result and its coverage-only control, as well as the full #345 result. It does not block the no-feedback #354 control, initial observation work or partial relation integration; those activities must report their coverage capability explicitly. Selection of a conversion tool should follow the measured cases below, without creating a general converter framework.

Goal

Map branch coverage produced by the pinned c8/V8 backend to TypeScript branch arms and EtsIR CFG edges.

Why

#350 and #381 map backend-neutral binary Istanbul if records to ordered true/false EtsIR successors. The current c8@10.1.3 path uses v8-to-istanbul@9.3.0, which converts every V8 block range into an independent Istanbul-shaped record with type: "branch" and exactly one location/count.

For example, when only the true side of an if/else runs, raw V8 coverage contains a zero-count range for the unexecuted else. When only the false side runs, it contains a zero-count range for the true body. The converted report does not preserve the originating if, the relationship between its arms, or the true/false outcome. It also emits similar records for function and script ranges. Therefore #381 reports these records as UNSUPPORTED instead of guessing CFG edges, while retaining usable statement mappings.

Statement coverage cannot reveal every missed edge. For example, if only the true side of an if without an else runs, every statement may be covered while the false edge remains untested.

Scope

• Evaluate an AST-aware V8-to-Istanbul converter, including Monocart, before implementing a custom conversion.
• Preserve enough raw V8 range hierarchy and source-map information to associate coverage with original TypeScript constructs.
• Produce backend-neutral binary if coverage with explicit true and false arms when the association is exact.
• Map those arms to ordered EtsIR CFG successors through the mapping layer introduced in [TS PBT] Map property coverage to EtsIR #381.
• Report ambiguous or unsupported cases instead of inferring an edge.
• Keep successfully mapped statement coverage available when branch reconstruction is not possible.
• Document which TypeScript branch constructs are supported; do not silently treat switch, conditional expressions, or logical short-circuit ranges as binary if records.

Definition of Done

• A real c8 run over a TypeScript if/else produces two correctly ordered backend-neutral arms and maps them to the true and false EtsIR successors.
• Separate true-only, false-only, and mixed executions preserve correct hit counts.
• Nested conditions, an if without else, source-map remapping, and ambiguous ranges have explicit tests and behavior.
• Function-level and script-level V8 block ranges are not misclassified as EtsIR conditional edges.
• Partial failures do not discard exact statement mappings.

Follow-up to #350 and #381.

Integration with property-aware feedback

• Feed exact outcomes to [TS PBT] Schedule assertion, coverage and hypothesis targets under one budget #399 and [TS PBT] Integrate the core iterative property-observation feedback loop #355; collecting/mapping an artifact without changing target selection does not complete the integration gate.
• Preserve property identity and, where supported by [TS PBT] Capture bounded property-scoped observations in original TypeScript #396, run/phase/precondition-admission provenance. Scope source-under-test separately from generated wrappers and assertion/precondition code. Report aggregate-only data explicitly.
• Coordinate source identities/probes with [TS PBT] Capture bounded property-scoped observations in original TypeScript #396/[TS PBT] Project observed relations and assertion goals into exact EtsIR bindings #398. If V8 ranges cannot recover exact arms for a construct, evaluate semantics-preserving AST branch probes as a bounded alternative and document their overhead; do not guess missing outcomes or create a universal converter framework.
• Keep already-covered edges available for data/property search. Coverage saturation is not property correctness.
• Add a real-backend integration fixture where independently changed PBT edge coverage changes the selected symbolic target, and a saturated-statement case still exposes an unvisited edge.
• Pin collector/converter/probe versions and demonstrate that instrumentation preserves the supported original execution semantics. [TS PBT] Evaluate causal contributions of property-aware feedback and bounded extensions #357 includes its full cost and reports the actual construct support.