feat(gates): WP-02 — harden check:tokens to whole-app colour guard

- Move the guard to scripts/check-tokens.sh; regex now catches hex +
  rgb()/hsl() (was hex-only) across ALL src/app components (was three
  ui/layout dirs). `token-ok` marker suppresses justified false positives;
  px stays out of scope (documented in the script).
- Zero exclusions: debug-state's dark code-editor palette moves to
  --app-devpanel-* tokens in styles.scss (the one exempt file), dropping its
  --exclude hole.
- Tokenize remaining hits: site-footer border via color-mix; three brief
  border widths via --rhc-border-width-* (new --rhc-border-width-lg: 3px).

Verified: planted violation fails the guard; GREEN + test-storybook:ci.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/check-tokens.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# WP-02 token guard: fail if any *.component.ts hardcodes a colour (hex/rgb/hsl)
+# instead of a --rhc-*/--app-* design token. Palette values live ONLY in the
+# styles.scss token bridge (the one exempt file — it IS the bridge).
+#
+# px/rem are deliberately NOT grepped: too many false positives (font sizes,
+# transforms, media queries). Raw border widths are fixed by hand and mapped to
+# --rhc-border-width-*; see docs/backlog/WP-02-check-tokens.md.
+#
+# Escape hatch: put a `token-ok` marker + reason on a line to suppress a justified
+# false positive (a colour word inside a comment or a data-URI). Keep the bar high.
+set -uo pipefail
+
+hits=$(grep -rnE '#[0-9a-fA-F]{3,8}\b|rgba?\(|hsla?\(' src/app --include='*.component.ts' | grep -v 'token-ok' || true)
+if [ -n "$hits" ]; then
+  echo "$hits"
+  echo 'FAIL: hardcoded colours in components (use --rhc-*/--app-* tokens, or add a `token-ok` marker + reason)'
+  exit 1
+fi
+echo 'OK: no hardcoded colours in components'