[Traceability] Dual locations for cross-file resolved calls (B2)

[AndresL230]

Summary

When a call is resolved through a wrapper, expose both the user's call site and the underlying SDK location. UI offers both as click targets.

Why

Today only one location is surfaced for cross-file-resolved calls. Users either land where they wrote their code (wrong if they want to see the SDK call) or land at the SDK (wrong if they want to see their own code). Both should be available.

Current state

cross-file-resolver.ts propagates calls but surfaces a single location per detection.

What to do

Add to propagated detections:

interface PropagatedLocation {
  callSite: SourceSpan;       // user's wrapper call
  resolvedSite: SourceSpan;   // underlying SDK call
  hops: number;               // 0 = direct, ≥1 = propagated
}

Default click lands on callSite. UI shows a "Show underlying call" affordance for resolvedSite.

Acceptance criteria

• Propagated detections carry both spans + hop count
• Direct detections have hops = 0 and equal spans
• Webview shows both with clear labels
• Stable IDs (B3) hash uses resolvedSite only, so refactoring the wrapper doesn't reset state

Depends on

• B1 (spans)
• A1 (wrapper depth >1 makes this useful)

Reference

Full design: https://github.com/recost-dev/extension/blob/main/docs/accuracy/traceability.md#b2-dual-locations-for-cross-file-resolved-calls