fix(qa): keep routine map checks keyless

Record keyless launch instructions without changing app defaults.
Block Google tile and token fallback requests in routine CCTV checks;
add a guarded startup check for both engines.

scripts/qa-map-policy.mjs

@@ -0,0 +1,15 @@
+/** Install before navigation, without intercepting workers or ordinary tiles. */
+export async function blockPaidQaMaps(page, { allowPaidMaps = false } = {}) {
+  if (allowPaidMaps) return;
+  const session = await page.createCDPSession();
+  await session.send('Network.enable');
+  await session.send('Network.setBlockedURLs', {
+    urls: [
+      '*://tile.googleapis.com/*',
+      '*://*.googleapis.com/*3dtiles*',
+      '*://api.cesium.com/v1/assets/2275207/*',
+      '*/api/google/tiles*',
+    ],
+  });
+  return session;
+}