feat: WP-07 site and asset pipeline

[N1k4G]

Moves dive sites to validated, renderer-neutral resources with an asset manifest, layer factories, culling, pooling and quality tiers, per Codex_Review.md WP-07.

Both acceptance criteria have passing tests

"Invalid site data fails at build/test time." src/sites/site-resources.ts validates on import and throws, targeting the failures that are silent rather than loud:

• lerpProfile walks points assuming ascending x. Unsorted input does not throw — it interpolates against the wrong segment and returns a plausible depth for the wrong place.
• An inverted structure box can never be hit by solidAt, so a wall quietly stops existing.

"One asset can be replaced without changing simulation or collision data." Re-pointing an asset at a different atlas and frame leaves every gameplay value byte-identical, and the two documents are asserted structurally disjoint so an art edit cannot reach collision again.

The separation is structural, not documentary

src/sites.js mixed collision, air, spawn and current data with features, visual zones, atmosphere and decoration rules in one object — so "change how a site looks" and "change where the diver can swim" were the same edit.

The generator partitions them into two documents and refuses to run if a descriptor grows a field in neither list. A new field must be deliberately classified, never silently dropped or silently promoted into collision.

Parity is proven against the real legacy source loaded via ?raw, not a snapshot, replaying floorAt, ceilingAt, solidAt, overheadAt and badAirAt across a sampled grid of every site including beyond the profile ends where clamping applies.

The parity test earned its place immediately

The first implementation folded lerpProfile's division into its multiplication:

legacy:  t = (x - a.x) / (b.x - a.x);  return a.d + (b.d - a.d) * t
mine:    return a.d + ((b.d - a.d) * (x - a.x)) / (b.x - a.x)

Algebraically identical, numerically not. It moved results by one ULP and broke parity on two of four sites. The operation order is now preserved deliberately, with a comment saying why.

The typechecker caught a second assumption: SiteFeature was modelled as a uniform {kind, x, d}, but real features include depth spans (dTop/dBottom) and kind-specific extras.

Renderer

The Pixi renderer added children in a flat list, so draw order was an accident of call order. It now owns named layer containers and populates them from the layer factory, with pooled markers and resync skipped until the camera has actually travelled.

Two deliberate limits:

• Markers are plain placeholder shapes. Production atlases are BLOCKED_EXTERNAL, so this draws something obviously provisional rather than art guessed at here. The manifest fixes the atlas/frame contract, so substituting real textures will not touch the renderer's structure.
• The hand-authored hull, seabed and engine stay. They are bespoke art for one scene, not authored site content; replacing them with markers would degrade the slice to prove a point the decoration layer already proves.

Known gap, worth raising before WP-08

The visual risk in the renderer change is unguarded. compare-rendering.mjs gates the legacy client only, so nothing here would catch a Pixi visual regression. This was verified structurally — build, e2e, layer assignment — but not visually.

Extending the pixel comparison to the Pixi client is the natural next work, and I would want it before WP-08 starts moving real scenes.

Verification

npm ci, npm run lint, npm run typecheck, npm run build, and npm test all pass. No change to the legacy client, the numerical model or the golden traces.