feat(gates): WP-02 — harden check:tokens to whole-app colour guard

- Move the guard to scripts/check-tokens.sh; regex now catches hex +
  rgb()/hsl() (was hex-only) across ALL src/app components (was three
  ui/layout dirs). `token-ok` marker suppresses justified false positives;
  px stays out of scope (documented in the script).
- Zero exclusions: debug-state's dark code-editor palette moves to
  --app-devpanel-* tokens in styles.scss (the one exempt file), dropping its
  --exclude hole.
- Tokenize remaining hits: site-footer border via color-mix; three brief
  border widths via --rhc-border-width-* (new --rhc-border-width-lg: 3px).

Verified: planted violation fails the guard; GREEN + test-storybook:ci.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/backlog/WP-02-check-tokens.md

@@ -1,6 +1,6 @@
 # WP-02 — Harden `check:tokens` + fix what it then catches
 
-Status: todo
+Status: done (pending commit)
 Phase: 0 — enforcement & gates
 
 ## Why
@@ -47,10 +47,10 @@ cover the whole app before the CIBG work (WP-10…13) leans on it.
 
 ## Acceptance criteria
 
-- [ ] Script scans all contexts and matches hex + rgb()/hsl().
-- [ ] Zero exclusions; any `token-ok` marker has a reason.
-- [ ] site-footer, debug-state, and the three brief components are tokenized.
-- [ ] A planted violation provably fails `npm run check:tokens`.
+- [x] Script scans all contexts and matches hex + rgb()/hsl().
+- [x] Zero exclusions; any `token-ok` marker has a reason. (No `token-ok` markers were needed.)
+- [x] site-footer, debug-state, and the three brief components are tokenized.
+- [x] A planted violation provably fails `npm run check:tokens`.
 
 ## Verification