Fix the review findings across the engines, layers, data and QA

Navara now matches Cesium where the review found it diverging: a flight
holds the camera inputs, camera.changed counts turns as Cesium does,
render requests made during a frame survive it, follow pinches zoom,
ground widths follow the pixel ratio and Cyber sonar reaches glyph caches
and models. On Cesium, a staged imagery swap keeps loading tiles, setView
replaces a running flight, and a cleared weather detail goes away.

The contract gains MoverSet.failed, maps.terrainRevision,
render.maxTextureSize and surface.sampleTerrainMostDetailed on every
engine, so layers retry failed models, key road heights by terrain,
size weather textures to the GPU and place Bhote Koshi cards on detailed
terrain.

Engine switches keep the live view, follows, focus, layer options and
cards: a pick hands over the exact pose, applies no address options and
pans no carried-over card; a history visit still applies its entry.

Layers put GhostMaps pins, cable landings, OSM Places and directions on
the measured surface without per-frame sampling, draw the Cockpit contact
dot, hide disabled CCTV on attach, and keep ALPR running outside secure
contexts. KML imports draw raised polygon fills, rotated and coloured
ground overlays and north-referenced icon headings, and report files
with nothing to draw.

QA scripts read the contract instead of Cesium internals (test:track is
109/109 again), wait for the camera to rest before clicking, and give
cold switches and parked engines realistic time. Docs follow the code.

docs/CODE-BOUNDARIES.md

@@ -80,10 +80,17 @@ self-package imports, symlinks and unreachable files.
 Runtime SDK imports are restricted by directory, including unreachable modules:
 `cesium` and `@cesium/*` belong in `src/globe/cesium/`; `three`,
 `postprocessing` and `@navaramap/*` belong in `src/globe/navara/`. Package
-subpaths, re-exports and literal dynamic imports obey the same rule. Tests and
-Node test support retain their existing exemptions. The production script
-loader is `src/app/loadCesium.js`; it imports no SDK package and needs no
-exception. There is no blanket exception for layer `render/` directories.
+subpaths, re-exports and literal dynamic imports obey the same rule, and the
+`<script>` blocks of Vue components count as runtime modules. A module outside
+the Navara engine reaches it only through `import()`: a static import of the
+same specifier fails even beside a dynamic one. Tests and Node test support
+retain their existing exemptions. The production script loader is
+`src/app/loadCesium.js`; it imports no SDK package and needs no exception, and
+it adds no `widgets.css` when the page's markup has already run `Cesium.js`
+(the MCP panel). The panel build replaces `src/app/navaraMode.js` and
+`src/globe/navara/windFlowMesh.js` with stubs (`build/panelNavara.js`), so the
+panel carries no Navara or three. There is no blanket exception for layer
+`render/` directories.
 
 The temporary `engineImportExceptions` list in `scripts/package-boundaries.json`
 contains exact file/package pairs with reasons. The checker reports the used
@@ -579,9 +586,9 @@ services into each family factory. Standalone provider selection lives in
 dependency graph, excluding standalone setup and compatibility layer instances.
 
 `src/app/layers/renderers.js` is the layer manifest. Its lazy display loaders
-resolve the shared factories exported by `displays.js`; `needs` names required
-contract primitives. The only display backend options are wind streamlines,
-loaded from the engine folders. A missing wind backend leaves the raster field
+resolve the shared factories exported by `displays.js` through `display`. All
+five drawing primitives are required by the globe contract. The only display
+backend options are wind streamlines, loaded from the engine folders. A missing wind backend leaves the raster field
 available. Wildlife Sightings draws itself through the contract; Sea Marks and
 Ski Pistes use their overlay controller. No layer display imports an engine SDK.
 `displayRehearsal.test.mjs` loads every manifest display on the fake engine with