Scope world overlays to each scene attachment

Move the world overlay into scene.services.overlay. Each attachment owns its
sources, collision domains, paint lanes, canvases, observers, timers and
accessible action subscribers. Keep both canvases inside the engine container,
with detection beside the card root so its screen blend still reaches the
scene. Release shared font measurements only after the last host detaches.

Resolve retained layer publications against their attached engine, clear the
outgoing source before releasing its renderer, and reconnect the shell's action
subscription on attachment. Keep destroyed hosts inert and give parked engines
fresh services. Bind annotation rectangles and the existing tracked bridge to
their engine's overlay. The tracked bridge itself remains page-owned.

Preserve Cesium's projection, card placement, arbitration, fades, hit tests,
blend order and render demand. Navara keeps the same shared behaviour. No
user-visible change is intended. Exercise simultaneous hosts, either teardown,
stale handles, reattachment and a retained selected card on the fake and
headless Cesium engines. Update QA reads and package ownership for the service.

No coupling metric falls or grows: renderer lines remain 0 Cesium and 189
Navara; external Cesium import files 3; viewer lines 891; Navara kind checks 1;
engine sniff calls 0; extension reads 3; ground passes 1; SDK loads 3;
ScreenSpaceEventHandler files 4; engine-name lines 32.

Each host now takes the page's overlay ids from the host it replaces and gives
them back to a remaining host when destroyed, and the chrome's static overlay
placeholders are gone. The new hosts had left the ids on those empty
placeholders, so the voice pointer policy, the id selectors and the QA probes
that read #world-overlay-canvas missed the drawn canvas.

Checked in the browser, keyless: the overlay baselines on both engines, CCTV
v2 (58 checks), military names, and the engine, voice, ground-layer and Ghost
Maps switches pass. The transit script fails the same 25 checks as before.

docs/CURRENT-STATE.md

@@ -283,7 +283,15 @@ one application, and only the globe-bound parts move to the next engine.
   Cesium implements its render mode directly. Retained layers identify their
   attached engine, and scene callbacks capture their governor. Teardown clears
   only that scene's holds; an old service cannot release a replacement's hold.
-  The overlay host and tracked readout still have module-owned state.
+- **Scene world overlays.** `scene.services.overlay` owns each attachment's
+  label sources, paint lanes, collision domains, canvases, observers, timers
+  and accessible actions. Both canvases live inside the engine container;
+  detection remains outside the card root to preserve its blend. Retained
+  models resolve their attached engine, and the shell reconnects its action
+  subscription after switching. Destroyed services and old lane handles stay
+  inert; a parked engine receives a new host. Shared font measurements live
+  until the last host detaches. The tracked readout remains page-owned and
+  publishes into the attached overlay; its event isolation is separate work.
 - **The session owns the state.** Catalog, layer models, sources, selection,
   camera mode and URL state outlive a switch. A layer that is a session model
   gets `attachRenderer(viewer, { engine })` / `detachRenderer()` instead of being rebuilt,