build: reach Navara only through import() and ship its worker wasm

The import-direction check now tells dynamic imports apart
(analyzeModule(source, { dynamic: true })) and rejects any static import
or re-export of src/globe/navara/** from outside that directory, so the
Navara engine can only be a lazily loaded chunk of the app.

Navara's prebuilt workers load their wasm by file name next to
themselves, which the bundler cannot see; a build-only Rollup plugin
copies the missing ones (draco decoder, font worker) into assets/ when
the bundle includes Navara, and adds nothing to a build without it.

scripts/module-analysis.mjs

@@ -15,9 +15,13 @@ const browserGlobals = new Set([
   'getComputedStyle',
 ]);
 
-/** Inspect literal module dependencies and browser-platform references without executing code. */
-export function analyzeModule(source) {
+/**
+ * Inspect literal module dependencies and browser-platform references without
+ * executing code. With `dynamic`, also list the import() specifiers apart.
+ */
+export function analyzeModule(source, { dynamic = false } = {}) {
   const imports = [];
+  const dynamicImports = [];
   const browser = new Set();
   function walk(node, parent, field) {
     if (!node || typeof node !== 'object') return;
@@ -35,6 +39,8 @@ export function analyzeModule(source) {
           'Computed module imports are not allowed in runtime code',
         );
       imports.push(node.source.value);
+      if (node.type === 'ImportExpression')
+        dynamicImports.push(node.source.value);
     }
     if (node.type === 'CallExpression' && node.callee?.name === 'require')
       throw new Error('Runtime modules must use ES imports');
@@ -71,7 +77,11 @@ export function analyzeModule(source) {
     }
   }
   walk(parsers.babel.parse(source));
-  return { imports, browser: [...browser] };
+  return {
+    imports,
+    browser: [...browser],
+    ...(dynamic && { dynamicImports }),
+  };
 }
 
 /** Return static imports, literal dynamic imports and re-exports. */