feat(gates): WP-02 — harden check:tokens to whole-app colour guard

- Move the guard to scripts/check-tokens.sh; regex now catches hex +
  rgb()/hsl() (was hex-only) across ALL src/app components (was three
  ui/layout dirs). `token-ok` marker suppresses justified false positives;
  px stays out of scope (documented in the script).
- Zero exclusions: debug-state's dark code-editor palette moves to
  --app-devpanel-* tokens in styles.scss (the one exempt file), dropping its
  --exclude hole.
- Tokenize remaining hits: site-footer border via color-mix; three brief
  border widths via --rhc-border-width-* (new --rhc-border-width-lg: 3px).

Verified: planted violation fails the guard; GREEN + test-storybook:ci.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/styles.scss

@@ -70,6 +70,7 @@
   --rhc-border-radius-round: 50%;
   --rhc-border-width-sm: 1px;
   --rhc-border-width-md: 2px;
+  --rhc-border-width-lg: 3px;
 
   /* — typography — */
   --rhc-text-font-size-sm: 0.875rem;
@@ -94,6 +95,16 @@ body { background: var(--rhc-color-wit); color: var(--rhc-color-foreground-defau
   --app-content-max: 67rem;                              /* readable page column */
   --app-form-narrow: 32rem;                              /* page-shell narrow variant */
   --app-skip-link-offset: -999px;                        /* off-screen skip link */
+
+  /* Dev-only state inspector (debug-state.component.ts, isDevMode-gated, never in
+     prod): a dark code-editor palette kept deliberately OFF the CIBG design system
+     so it reads as a tool, not product chrome. Defined here (the one exempt file)
+     so the component itself stays colour-token-only. */
+  --app-devpanel-bg: #1e1e1e;
+  --app-devpanel-fg: #d4d4d4;
+  --app-devpanel-accent: #9cdcfe;
+  --app-devpanel-border: #444;
+  --app-devpanel-shadow: rgb(0 0 0 / 0.4);
 }
 
 /* App utility classes: centralise the repeated inline layout idioms so components stay