refactor(ui): navigation, orientation, share links and HUD use the globe engine

The application shell keeps the page's globe engine and hands it to the
navigation controller, location navigation (search, city and POI flights,
orbit, globe reset), the tilt and north-up controls, share-link save and
restore, share restoration's first-gesture listeners and the HUD. The
viewer is passed only where entity tracking still lives on it (phase 1c)
and to the HUD's basemap label context (voice); every such use is null-safe.

Share links and captured shots write heading and roll as Cesium's camera
reports them (src/cameraAngles.js): the contract's [0, 2π) pose maps an
exact 0 back to Cesium's 2π, except the roll of a vertical view, so
links stay byte-identical (heading=360, roll=360) on every engine.

Source-reading tests follow the moved code with the same checks.

scripts/package-boundaries.json

@@ -551,6 +551,7 @@
     "exports": ["./ui/shell"],
     "modules": [
       "src/globe/cesium/engineFromViewer.js",
+      "src/cameraAngles.js",
       "src/globe/contract.js",
       "src/hudLayouts.js",
       "src/hudLayoutPolicy.js",
@@ -1696,6 +1697,7 @@
       "./standalone/catalog"
     ],
     "modules": [
+      "src/cameraAngles.js",
       "src/cyberSonarScene.js",
       "src/cyberSonar.js",
       "src/hudLayouts.js",