build: the initial-chunk guard covers Navara's whole dependency closure

Review of Task 0:
- build/navaraDependencies.js reads the dependency closure of
  @navaramap/three and @navaramap/three-default-plugin from node_modules
  (dependencies and peers) and drops what the app's other bundled
  dependencies reach too (Cesium is served as a script, so draco3d, which
  only Cesium shares, stays engine-only), plus three and postprocessing:
  88 packages today (the @navaramap/* packages, @takram/*, @react-three/
  fiber, @sparkjsdev/spark, astronomy-engine, d3*, draco3d, n8ao,
  three-stdlib, …). The browser build's initialChunkGuard fails on a
  module from any of them in an initial chunk. Tested on a fixture tree.
- check-main-chunk's budget measures the entry the page loads (the same
  chunk the composition check reads), falling back to phase 4's largest
  index-*.js only for a dist without a page.

Build clean: no Navara-only module in the initial chunks; main chunk
2,869,565 bytes (gzip 889,041).

src/tooling/initialChunkGuard.test.mjs

@@ -74,5 +74,5 @@ test('the plugin fails the build on a violation and passes a clean bundle', () =
   broken['assets/index-A.js'].moduleIds.push('/r/node_modules/three/a.js');
   plugin.generateBundle.call(context, {}, broken);
   assert.equal(errors.length, 1);
-  assert.match(errors[0], /three.*index-A\.js/s);
+  assert.match(errors[0], /Navara-only.*index-A\.js.*three/s);
 });

src/tooling/mainChunkComposition.test.mjs

@@ -102,3 +102,20 @@ test('the script exports the gzip budget check (phase 4 shape) next to the compo
   assert.equal(measured.name, 'index-main.js');
   assert.ok(measured.gzipBytes > 0 && measured.gzipBytes < 5000);
 });
+
+test('the budget measures the entry the page loads, not the largest index chunk', async () => {
+  const { mkdirSync, mkdtempSync, writeFileSync } = await import('node:fs');
+  const { tmpdir } = await import('node:os');
+  const path = await import('node:path');
+  const { measureMainChunk } =
+    await import('../../scripts/check-main-chunk.mjs');
+  const dist = mkdtempSync(path.join(tmpdir(), 'gev-main-entry-'));
+  mkdirSync(path.join(dist, 'assets'));
+  writeFileSync(path.join(dist, 'assets/index-entry.js'), 'x'.repeat(100));
+  writeFileSync(path.join(dist, 'assets/index-lazy.js'), 'y'.repeat(50000));
+  writeFileSync(
+    path.join(dist, 'index.html'),
+    '<script type="module" src="/assets/index-entry.js"></script>',
+  );
+  assert.equal(measureMainChunk(dist).name, 'index-entry.js');
+});

src/tooling/navaraDependencies.test.mjs

@@ -0,0 +1,69 @@
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  navaraOnlyPackages,
+  packagePattern,
+} from '../../build/navaraDependencies.js';
+
+function tree(packages, app) {
+  const root = mkdtempSync(path.join(tmpdir(), 'gev-navara-deps-'));
+  writeFileSync(path.join(root, 'package.json'), JSON.stringify(app));
+  for (const [name, dependencies] of Object.entries(packages)) {
+    const dir = path.join(root, 'node_modules', name);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(
+      path.join(dir, 'package.json'),
+      JSON.stringify({ name, dependencies }),
+    );
+  }
+  return root;
+}
+
+test('engine-only packages: the Navara closure minus what the bundled app reaches', () => {
+  const root = tree(
+    {
+      '@navaramap/three': { 'd3-geo': '1', shared: '1', draco3d: '1' },
+      '@navaramap/three-default-plugin': { 'astronomy-engine': '1' },
+      'd3-geo': { 'd3-array': '1' },
+      'd3-array': {},
+      'astronomy-engine': {},
+      shared: {},
+      draco3d: {},
+      'mapillary-js': { shared: '1', three: '1' },
+      cesium: { draco3d: '1' },
+      three: {},
+    },
+    {
+      dependencies: {
+        '@navaramap/three': '1',
+        '@navaramap/three-default-plugin': '1',
+        'mapillary-js': '1',
+        cesium: '1',
+        three: '1',
+      },
+    },
+  );
+  assert.deepEqual(navaraOnlyPackages(root), [
+    '@navaramap/three',
+    '@navaramap/three-default-plugin',
+    'astronomy-engine',
+    'd3-array',
+    'd3-geo',
+    'draco3d', // only Cesium (external, not bundled) reaches it too
+    'postprocessing',
+    'three',
+  ]);
+});
+
+test('the pattern matches node_modules/<package>/ and nothing longer', () => {
+  const pattern = packagePattern(['three', '@navaramap/three', 'd3-geo']);
+  assert.ok(pattern.test('/r/node_modules/three/build/three.module.js'));
+  assert.ok(pattern.test('C:\\r\\node_modules\\@navaramap\\three\\dist\\i.js'));
+  assert.ok(pattern.test('/r/node_modules/d3-geo/src/index.js'));
+  assert.ok(!pattern.test('/r/node_modules/three-geojson/index.js'));
+  assert.ok(!pattern.test('/r/node_modules/d3-geo-projection/index.js'));
+  assert.ok(!pattern.test('/r/src/layers/threeD.js'));
+});