Preserve authored JavaScript boundaries

[BenCodez]

Summary

• identify operator-authored [Javascript=...] regions before placeholder replacement
• keep placeholder-generated marker text non-executable
• preserve existing inline marker, reward JavaScript, requirement JavaScript, item conditional, and admin command syntax
• resolve JavaScript placeholders automatically through Rhino AST-classified bindings instead of copying expression values into source
• preserve quoted string, template literal, and regular-expression semantics
• fail closed when JavaScript cannot be parsed safely instead of using a handwritten syntax fallback
• retain custom-placeholder precedence and custom-to-PlaceholderAPI chaining

Compatibility

Existing authored JavaScript remains unchanged, including normal API calls such as:

Player.hasPermission("some.permission") == true

Existing PlaceholderAPI/custom placeholders inside JavaScript also remain automatic:

%permission_result% == true
'%player_name%' == 'Ben'
`Hello %player_name%`
/^%player_name%$/.test(value)
{count} > 0

The intentional security change is that a placeholder result can no longer create a new executable [Javascript=...] marker. Only markers present before placeholder output is applied are executable.

Validation

The branch finalization workflow runs mvn -B -f AdvancedCore/pom.xml package and removes all temporary implementation files before committing the reviewable tree.

Supersedes #302.