Scope render demand to each scene attachment

Give each scene its own render governor, owner holds and recent idle requests.
Make the Cesium render backend own its request mode directly, so the governor
drives engine.render on both engines without a dependency back from Cesium.
Route layer requests through their attached engine and capture the attachment's
governor for camera motions, orbit, annotations and shell controls. Release
retained-layer holds before clearing the outgoing engine, and destroy the
governor after scene consumers have detached.

Preserve Cesium's owner-keyed holds, pre-install buffering, last-release settling
frame and one-shot requests during continuous rendering. Navara keeps the same
render policy. There is no intended visible change on either engine. Simultaneous
scenes no longer share holds, and an old captured service cannot release a
replacement attachment's hold. Cover both rules on fake and headless Cesium
engines, including an old orbit ending after reattachment.

Viewer-reference lines fall from 910 to 891, Navara-kind checks from 2 to 1,
and engine-name lines from 33 to 32. All other coupling counts stay unchanged.

Checked in the browser, keyless: qa-perf passes on both engines with the
same idle, active and release counts as before (24 checks on Cesium, 22 on
Navara).

docs/CODE-BOUNDARIES.md

@@ -534,7 +534,7 @@ perform no network requests and discover no additional modules.
 `maps/controller` coordinates scene changes and lifetimes. `maps/imagery`,
 `maps/terrain` and `maps/3d` supply constructors; `maps/defaults` selects the
 standard sources and their setup/fallback policy. The standalone facade wires
-these to the application's render governor.
+these to their engine's render requests.
 
 A registry supplies `sources`, `defaultId`, `unknownId` and optional `recoveryId`.
 Each source has a user-facing `descriptor`, availability/reason, and either an
@@ -638,8 +638,11 @@ refresh policy. `app/layerSession.js` defines the retained session fields and
 handoff predicate. `standalone/sceneSwitcher.js` coordinates page handoff;
 `ui/shellScene.js` owns scene-bound shell construction, while `applicationShell`
 keeps page controls and policy. Request, host and shell queues are not yet one
-queue. Overlay, render-governor, tracked-readout and pick services still include
-module singletons; debug access still exposes the native viewer and tileset.
+queue. Pick ownership, selection dispatch and render demand belong to
+`scene.services`; render demand drives the engine contract, with no dependency
+from the Cesium render backend to the governor. Overlay and tracked-readout
+services still include module singletons; debug access still exposes the native
+viewer and tileset.
 
 ## UI state owners