perf: O(1) builtin lookups + SCIP resolvedBy type

[MO2k4]

Summary

• Add module-level Set objects (jsBuiltIns, reactHooks, pythonBuiltIns) for O(1) built-in/external reference filtering, replacing inline array .includes() checks in isBuiltInOrExternal()
• Add isPathWithinRoot validation in fileExists and readFile resolution context methods to prevent path traversal
• Add 'scip' to the resolvedBy union type in preparation for SCIP import support

Details

The builtin sets are defined at module scope so they're allocated once. Previously, isBuiltInOrExternal used local arrays with .includes() on every call — O(n) per lookup. With Set.has(), each lookup is O(1).

The isPathWithinRoot guard uses the existing utility from src/utils.ts to block path traversal attempts in the resolution context's fileExists and readFile methods, matching the security pattern already used elsewhere in the codebase.

The 'scip' addition to resolvedBy is a type-only change that extends the union to support SCIP-based resolution results.

Test plan

• npm run build compiles without errors
• npm test passes with same baseline (28 pre-existing failures, 326 passing)
• Only 2 files changed: src/resolution/index.ts, src/resolution/types.ts
• Zero new uncalled exports
• Sentry (captureException) preserved — 3 call sites in resolution/index.ts
• No upstream features removed