Batch: #1134 dock + #1127 (Sep-14 batch) + codeql-action 4.38.1 (#1128/#1131/#1132)

[zkWizard]

This is an integration batch, so the required E2E smoke (WebGL) job (~45 min) runs once for these PRs instead of once each under the up-to-date ruleset. Each PR's head commit is merged in unchanged, so GitHub marks the originals as merged when this lands.

Included

• Replace the bottom HUD with a compact dock (301px → 73px on desktop) #1134: the compact HUD dock (reviewed; green on its own).
• Batch: dependabot bumps + #1108 + #1110 + #1053 #1127: the Sep-14 batch (green on its own), which already contains:
  • Stop a bare-node search box collapsing to a zero-sized extent #1108: the search-extent span no longer collapses to 0.0 km
  • Let Escape close only the overlay on top #1110: Escape closes only the topmost overlay
  • Add Cursor Cloud environment setup instructions #1053: AGENTS.md (Cursor Cloud setup notes, docs only)
  • Bump @vitest/mocker and vitest #1121: vitest / @vitest/mocker 4.1.x
  • Bump three from 0.185.1 to 0.186.0 #1122: three 0.185.1 → 0.186.0
  • CodeQL 4.37.7 → 4.38.0 (from Bump github/codeql-action/init from 4.37.7 to 4.38.0 #1124–Bump github/codeql-action/upload-sarif from 4.37.7 to 4.38.0 #1126)
  • the non-vite dev-dependency bumps from Bump the dev-dependencies group across 1 directory with 5 updates #1123
• Bump github/codeql-action/upload-sarif from 4.37.7 to 4.38.1 #1128, Bump github/codeql-action/init from 4.37.7 to 4.38.1 #1131, Bump github/codeql-action/analyze from 4.37.7 to 4.38.1 #1132: CodeQL upload-sarif, init and analyze 4.38.0 → 4.38.1. These must land together: on their own, Bump github/codeql-action/init from 4.37.7 to 4.38.1 #1131 and Bump github/codeql-action/analyze from 4.37.7 to 4.38.1 #1132 each fail Analyze on an init/analyze version mismatch. The conflicts with Batch: dependabot bumps + #1108 + #1110 + #1053 #1127's 4.38.0 lines were resolved to dependabot's 4.38.1 pins verbatim, and the workflow diff against main is exactly those three uses: lines.

Not included

• Bump vitest from 4.1.11 to 5.0.1 #1130 (vitest 5.0.1): it conflicts with Bump @vitest/mocker and vitest #1121's vitest 4.1.11 in package.json and the lockfile, and resolving that means regenerating the lockfile by hand. It's left to go through on its own after dependabot rebases it onto this.
• Bump the dev-dependencies group with 7 updates #1129 (7 dev-dependency bumps): it fails the bundle budget because of vite 8.3.0. Its rolldown pulls three lazy chunks into the entry bundle, taking it from 54 to ~76 kB gzip against a 60 kB budget. It's the same break Batch: dependabot bumps + #1108 + #1110 + #1053 #1127 already held back. The other six bumps in it are fine.

Local verification

npm ci, tsc --noEmit, eslint ., prettier --check, 286 files / 4664 unit tests pass, catalog check passes, and the build's entry bundle is 55.2 kB gzip (budget 60).

🤖 Generated with Claude Code