build: reach Navara only through import() and ship its worker wasm

The import-direction check now tells dynamic imports apart
(analyzeModule(source, { dynamic: true })) and rejects any static import
or re-export of src/globe/navara/** from outside that directory, so the
Navara engine can only be a lazily loaded chunk of the app.

Navara's prebuilt workers load their wasm by file name next to
themselves, which the bundler cannot see; a build-only Rollup plugin
copies the missing ones (draco decoder, font worker) into assets/ when
the bundle includes Navara, and adds nothing to a build without it.

docs/CODE-BOUNDARIES.md

@@ -70,7 +70,9 @@ architectural check, not a JavaScript sandbox. The globe contract
 helpers, nor import an engine implementation; the `src/globe/cesium/**` graph
 reaches no Navara/three package or `src/globe/navara/**` module, and the
 `src/globe/navara/**` graph no Cesium package or `src/globe/cesium/**` module,
-through helpers too. Common voice controls cannot depend on a
+through helpers too. Outside its own directory, `src/globe/navara/**` is
+reached only through a literal `import()` (the app's `?engine=navara` mode), so
+Navara stays out of the Cesium-mode bundle. Common voice controls cannot depend on a
 Realtime protocol implementation. Negative fixtures cover indirect helpers,
 self-package imports, symlinks and unreachable files.