Move signed-out and lazy-only code out of the initial bundle

The initial JavaScript entry was within bytes of its budget because shared
modules imported by the entry carried every export their lazy consumers use.

- Split the repository snapshot reader and validators from the cache-clearing
  helper the entry needs.
- Load the GitHub sign-in page and the legacy /channels route lazily.
- Keep the child-focus reducer in child-history so AnchoredChildSurface stays
  in the document host chunk.
- Move device-authorization and research-request calls next to their only
  consumers.

Initial JavaScript: 255781 -> 246743 B raw, 80560 -> 77694 B gzip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>