A group variable says package: httpd, the play's vars say package: nginx, and you run ansible-navigator run site.yml -e package=lighttpd. Which value is used, and why?

lighttpd. Extra variables given with -e / --extra-vars have the highest priority and override every other definition of the same name.

Walking up the ladder:

1. The inventory's group variable sets httpd. That is the lowest level.
2. The play's vars block sets nginx. Play variables beat inventory variables, so nginx would win so far.
3. -e package=lighttpd is an extra variable. Nothing outranks it, so lighttpd is used.

Without -e, the result would be nginx. This is also why -e is useful for one-off overrides ("deploy version 2.3 just this once") without editing any file. The flip side: a value forced with -e cannot be changed by anything inside the playbook, which can surprise you if you forget you passed it.

Go deeper:

• Defining variables at runtime (official docs) — key=value, JSON and @file forms of --extra-vars.