JS: Complete migration to shared SSA

Use shared SSA for definitions, refinements, captures, and local/global data flow. Remove JavaScript's separate liveness, phi insertion, and reaching-definition computation while preserving its public SSA APIs as shared-backed adapters.

Keep global continuing-value reads distinct from expression occurrences, preserve captured-variable and legacy Configuration guard behavior, and restrict reflective with-read shortcuts to type inference.

Propagate post-updates after operation completion and preserve updates across value-preserving reassignments using the existing modeled may-value flow.

Update test expectations and the change note. Keep known baseline clone and short-circuit false positives marked SPURIOUS.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: owen-mc

javascript/ql/lib/change-notes/2026-10-29-shared-ssa.md

@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* JavaScript and TypeScript data flow now use the shared SSA implementation, including refinements and conservative captured-variable definitions. The existing public SSA APIs remain available as shared-backed adapters; the separate JavaScript SSA computation has been removed. This improves barrier-guard handling at control-flow joins, reducing false positives when guarded and overwritten values merge, and improves the ordering of post-update flow around calls and assignments.