refactor: share API reference tracking across rules - #2193

Motivation

Node API rules and unicorn/no-document-cookie implement overlapping alias, destructuring and property traversal. Keeping both implementations makes future rule ports repeat scope and JavaScript evaluation logic.

The extraction also exposed a Node false negative: ({require} = globalThis); require('fs') bypasses node/no-restricted-require, and ({Buffer} = globalThis); new Buffer() bypasses node/no-deprecated-api. A shorthand assignment's property symbol was incorrectly treated as a variable binding.

Changes

• Share API traversal in internal/utils/referencetracker, reusing RuleContext.Refs, the cached reference index, tsgo binding helpers and the existing static evaluator. Migrate Node's adapter and unicorn/no-document-cookie; keep module loading, builtin aliases and strict/legacy ESM policies in Node.
• Add computed property-name queries to StaticStringEvaluator. Reference tracking retains upstream's no-scope key evaluation; existing literal-only helpers keep their contracts.
• Fix shorthand global aliases with the existing declaration predicate, without a compatibility mode or alternate symbol resolver. Add regressions to all five affected rule suites, plus shared traversal/cache and TypeScript binding tests.
• Document the shared APIs in the architecture and rule utility reference.

Validation passed:

• go test ./internal/utils -run '^TestStaticStringEvaluatorPropertyNames$'
• go test ./internal/utils/referencetracker ./internal/plugins/node/rules/no_deprecated_api ./internal/plugins/node/rules/no_restricted_require ./internal/plugins/node/rules/no_extraneous_require ./internal/plugins/node/rules/no_path_concat ./internal/plugins/unicorn/rules/no_document_cookie
• golangci-lint run --new-from-merge-base=origin/main ./internal/utils ./internal/utils/referencetracker ./internal/plugins/node/nodeutil ./internal/plugins/node/rules/no_deprecated_api ./internal/plugins/node/rules/no_restricted_require ./internal/plugins/node/rules/no_extraneous_require ./internal/plugins/node/rules/no_path_concat ./internal/plugins/unicorn/rules/no_document_cookie: 0 issues.
• pnpm run check-spell with all 15 changed paths explicitly supplied, including .agents/; pnpm run format:check passed.
• Native CLI before/after comparison over 320 JS/TS inputs: all 369 original diagnostics retained with identical messages, ranges and multiplicity; only the two confirmed shorthand-alias diagnostics were added. The corpus covers four rules; the extraneous-require regression is covered by its Go suite.
• Checked shorthand aliases against eslint-utils 4.10.1 and affected TypeScript binding cases against Unicorn 72.0.0 with the TypeScript ESLint parser.

Validation is scoped to the affected Go consumers and native CLI behavior; whole-repository suites and JS integration suites were not run.