test: cover navigation browser contracts

[Banegasn]

Summary

Partially addresses #12.

This is the first focused browser-contract batch. It deliberately covers only the public navigation family:

• @banegasn/m3-navigation-bar
• @banegasn/m3-navigation-rail

It adds reusable Lit browser-contract helpers; deterministic layout, event, slot, accessibility, reconnect-cleanup coverage; and an Istanbul browser-coverage ratchet. The two packages run in Chromium, Firefox, and WebKit and are ratcheted at 100% statements, branches, functions, and lines. CI prints the summaries without retaining coverage artifacts.

Follow-up plan

Continue #12 in focused public component-family batches (for example, button/chip/badge or input controls), adding a package to the ratchet only after all of that package production source is exercised in the three-browser matrix. Do not treat the remaining packages that still use the explicit temporary no-test status as covered.

Validation

• pnpm lint
• pnpm typecheck
• pnpm --filter @banegasn/m3-navigation-bar test:coverage
• pnpm --filter @banegasn/m3-navigation-rail test:coverage
• pnpm tokens:check
• pnpm build
• pnpm audit:prod
• pnpm smoke:packages
• pnpm smoke:svelte-vite
• pnpm verify:package-licenses

pnpm test is otherwise clean for this batch but currently fails on the pre-existing WebKit-only m3-menu test synchronously hides and escapes the menu when a real Tab key moves focus: WebKit leaves document.activeElement on body instead of the expected next button. This PR does not modify the already-merged menu contract.

[Banegasn]

Acceptance review found two P1 blockers:

1. This navigation-only batch must not auto-close [P1] Build a cross-browser component contract test matrix and coverage baseline #12, whose repository-wide package coverage criteria remain incomplete. Replace Fixes #12 with Partially addresses #12 (or equivalent) and retain the staged follow-up plan.
2. Add explicit event-contract assertions for bubbles, composed, and cancelable (including rail item-click); the issue requires all four public event flags and current tests omit cancelability.

Implementation has been returned for these focused fixes.