Wire bake orchestrator and CLI

Connects scan + lock + pack + write into the full pipeline. CLI entry
parses args, dispatches to bake(), prints summary or error. Five
integration tests cover fresh bake, lock-aware ID preservation,
deleted-tile tracking, oversize hard-fail, and bit-identical
determinism across re-bakes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/bake-oversize-fail.test.js

@@ -0,0 +1,32 @@
+const { test } = require('node:test');
+const assert = require('node:assert');
+const path = require('node:path');
+const fs = require('node:fs');
+const os = require('node:os');
+const { PNG } = require('pngjs');
+const { bake } = require('../src/bake');
+
+test('bake-oversize: tile that does not fit hard-fails', async () => {
+    const srcDir = fs.mkdtempSync(path.join(os.tmpdir(), 'atlas-over-src-'));
+    const outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'atlas-over-out-'));
+    try {
+        // Single huge 256x256 tile, max canvas 128 -> cannot fit
+        const png = new PNG({ width: 256, height: 256 });
+        png.data.fill(255);
+        fs.writeFileSync(path.join(srcDir, 'huge_diffuse.png'), PNG.sync.write(png));
+
+        await assert.rejects(
+            () => bake({
+                inDir: srcDir,
+                outDir,
+                atlasId: 'over',
+                tileSize: 256,
+                maxSize: 128,
+            }),
+            /does not fit/,
+        );
+    } finally {
+        fs.rmSync(srcDir, { recursive: true, force: true });
+        fs.rmSync(outDir, { recursive: true, force: true });
+    }
+});