Scope render demand to each scene attachment

Give each scene its own render governor, owner holds and recent idle requests.
Make the Cesium render backend own its request mode directly, so the governor
drives engine.render on both engines without a dependency back from Cesium.
Route layer requests through their attached engine and capture the attachment's
governor for camera motions, orbit, annotations and shell controls. Release
retained-layer holds before clearing the outgoing engine, and destroy the
governor after scene consumers have detached.

Preserve Cesium's owner-keyed holds, pre-install buffering, last-release settling
frame and one-shot requests during continuous rendering. Navara keeps the same
render policy. There is no intended visible change on either engine. Simultaneous
scenes no longer share holds, and an old captured service cannot release a
replacement attachment's hold. Cover both rules on fake and headless Cesium
engines, including an old orbit ending after reattachment.

Viewer-reference lines fall from 910 to 891, Navara-kind checks from 2 to 1,
and engine-name lines from 33 to 32. All other coupling counts stay unchanged.

Checked in the browser, keyless: qa-perf passes on both engines with the
same idle, active and release counts as before (24 checks on Cesium, 22 on
Navara).

docs/CURRENT-STATE.md

@@ -277,8 +277,13 @@ one application, and only the globe-bound parts move to the next engine.
   resolve these services with their attached engine; simultaneous engines do
   not share owner predicates or click subscriptions. Detach releases both
   services before the renderer is parked. Reattachment creates fresh services,
-  while retained layers register their current picks again. The overlay host,
-  render governor and tracked readout still have module-owned state.
+  while retained layers register their current picks again.
+- **Scene render demand.** `scene.services.render` owns the attachment's holds
+  and recent idle requests. It drives `engine.render` on both engines;
+  Cesium implements its render mode directly. Retained layers identify their
+  attached engine, and scene callbacks capture their governor. Teardown clears
+  only that scene's holds; an old service cannot release a replacement's hold.
+  The overlay host and tracked readout still have module-owned state.
 - **The session owns the state.** Catalog, layer models, sources, selection,
   camera mode and URL state outlive a switch. A layer that is a session model
   gets `attachRenderer(viewer, { engine })` / `detachRenderer()` instead of being rebuilt,