build: guard the initial chunks by module id; main-chunk check in CI

Review of Task 0:
- build/initialChunkGuard.js, a Rollup plugin in the browser build, fails
  the build when an initial chunk (an entry and what it imports
  statically) holds a module from node_modules/three, @navaramap/* or
  postprocessing. Checked by forcing it on satellite.js, which the main
  chunk does hold: the build fails naming the chunk and module.
  navaraAssets.test now pins both build plugins.
- scripts/check-main-chunk.mjs is one script for both main-chunk checks:
  the composition (text markers in the initial chunks, sizes) and, when
  scripts/main-chunk-baseline.json exists, the phase-4 branch's gzip-9
  budget, with its exports (checkMainChunk, measureMainChunk) so the two
  branches merge into this file. The composition test moved to
  src/tooling/mainChunkComposition.test.mjs to leave phase 4's
  mainChunk.test.mjs its name.
- CI runs npm run check:main-chunk after each npm run build (unit,
  browser-gate and Windows jobs).

build/initialChunkGuard.js

@@ -0,0 +1,52 @@
+// Build guard: the Cesium-mode page must not load three or Navara. The
+// initial chunks are every entry chunk and what it imports statically;
+// navaraMode.js reaches Navara only through import(), so three and
+// @navaramap/* belong to lazy chunks. This checks the bundle's module ids
+// (what Rollup put in each chunk), and fails the build otherwise;
+// scripts/check-main-chunk.mjs checks the built files' text as well.
+
+/** Module ids that only the Navara engine may load. */
+export const ENGINE_ONLY_MODULES =
+  /[\\/]node_modules[\\/](?:three|@navaramap[\\/][^\\/]+|postprocessing)[\\/]/;
+
+/**
+ * Engine-only modules in initial chunks of a Rollup bundle, sorted by chunk.
+ * @param {Record<string, { type: string, isEntry?: boolean, imports?: string[], moduleIds?: string[] }>} bundle
+ * @returns {{ chunk: string, module: string }[]}
+ */
+export function initialChunkViolations(bundle, pattern = ENGINE_ONLY_MODULES) {
+  const initial = new Set();
+  const visit = (fileName) => {
+    const chunk = bundle[fileName];
+    if (!chunk || chunk.type !== 'chunk' || initial.has(fileName)) return;
+    initial.add(fileName);
+    for (const imported of chunk.imports ?? []) visit(imported);
+  };
+  for (const [fileName, chunk] of Object.entries(bundle))
+    if (chunk.type === 'chunk' && chunk.isEntry) visit(fileName);
+  const violations = [];
+  for (const fileName of [...initial].sort())
+    for (const module of bundle[fileName].moduleIds ?? [])
+      if (pattern.test(module)) violations.push({ chunk: fileName, module });
+  return violations;
+}
+
+/** The Rollup plugin: fails generateBundle when an initial chunk holds three or Navara. */
+export function initialChunkGuard({ log = console.log } = {}) {
+  return {
+    name: 'gev-initial-chunk-guard',
+    generateBundle(_options, bundle) {
+      const violations = initialChunkViolations(bundle);
+      if (violations.length) {
+        this.error(
+          'three/Navara in the Cesium-mode initial chunks:\n' +
+            violations
+              .map(({ chunk, module }) => `  ${chunk}: ${module}`)
+              .join('\n'),
+        );
+        return;
+      }
+      log('[initial-chunks] no three or Navara modules in the initial chunks');
+    },
+  };
+}

build/vite.js

@@ -4,6 +4,7 @@ import { DEFAULT_ALLOWED_HOSTS, hostCheckPlugin } from './allowedHosts.js';
 import { embedFramingPlugin } from './embed-framing.js';
 import { panelBuildPlugin } from './panel.js';
 import { navaraChunkFileNames, navaraWorkerAssets } from './navaraAssets.js';
+import { initialChunkGuard } from './initialChunkGuard.js';
 
 /**
  * Content-Security-Policy for every document the dev/preview server serves.
@@ -132,7 +133,8 @@ export function createBrowserViteConfig({
       // engine is a separate chunk loaded on ?engine=navara).
       // The lazy chunk with the Navara engine is named navara-engine.
       rollupOptions: {
-        plugins: [navaraWorkerAssets()],
+        // initialChunkGuard: no three/Navara module in the initial chunks.
+        plugins: [navaraWorkerAssets(), initialChunkGuard()],
         output: { chunkFileNames: navaraChunkFileNames },
       },
     },