build: guard the initial chunks by module id; main-chunk check in CI

Review of Task 0:
- build/initialChunkGuard.js, a Rollup plugin in the browser build, fails
  the build when an initial chunk (an entry and what it imports
  statically) holds a module from node_modules/three, @navaramap/* or
  postprocessing. Checked by forcing it on satellite.js, which the main
  chunk does hold: the build fails naming the chunk and module.
  navaraAssets.test now pins both build plugins.
- scripts/check-main-chunk.mjs is one script for both main-chunk checks:
  the composition (text markers in the initial chunks, sizes) and, when
  scripts/main-chunk-baseline.json exists, the phase-4 branch's gzip-9
  budget, with its exports (checkMainChunk, measureMainChunk) so the two
  branches merge into this file. The composition test moved to
  src/tooling/mainChunkComposition.test.mjs to leave phase 4's
  mainChunk.test.mjs its name.
- CI runs npm run check:main-chunk after each npm run build (unit,
  browser-gate and Windows jobs).

.github/workflows/ci.yml

@@ -59,6 +59,9 @@ jobs:
       - name: Build production bundle
         run: npm run build
 
+      - name: Main chunk (no three or Navara in Cesium mode; size budget when recorded)
+        run: npm run check:main-chunk
+
   street-level-browser:
     # Hermetic: every Mapillary request is answered from fixtures, so the
     # dummy token below never leaves the page.
@@ -89,6 +92,9 @@ jobs:
           MAPILLARY_CLIENT_TOKEN: 'MLY|0|qa-fixture'
         run: npm run build
 
+      - name: Main chunk (no three or Navara in Cesium mode; size budget when recorded)
+        run: npm run check:main-chunk
+
       - name: Start the preview server
         env:
           MAPILLARY_CLIENT_TOKEN: 'MLY|0|qa-fixture'
@@ -154,3 +160,6 @@ jobs:
 
       - name: Build production bundle
         run: npm run build
+
+      - name: Main chunk (no three or Navara in Cesium mode; size budget when recorded)
+        run: npm run check:main-chunk