style: consume the canonical cool design tokens from openadapt-web

[abrichr]

What was wrong

docs.openadapt.ai was serving the retired warm palette. It was not stale. The
Sync Documentation workflow ran and succeeded, and the CSS on the live site
matched the CSS on main byte for byte. Read from the live page:

--oa-ground   #f2f1ec      --surface          (undefined)
--oa-panel    #fdfcf9      --ink              (undefined)
--oa-ink      #23281f      --accent-verified  (undefined)
body background  rgb(242, 241, 236)

The source was simply four weeks behind: openadapt-web owns the tokens,
openadapt-cloud adopted them in its #325, openadapt-desktop in its #139, and
tokens.json already listed openadapt-ops docs (vendor + hash-check) among
its consumers. This makes that line true.

What carried the old palette

Three of the four carriers were invisible to a search for token names, and two
were invisible to a search of stylesheets.

where	what	how it hid
docs/stylesheets/brand.css	a private copy of the whole palette as hex literals	no canonical token name appears in it
docs/assets/logo.svg	fill="#23281F"	a stylesheet search does not reach an SVG
7 of 10 shipped images	grounds measuring #f2f1ec, #fdfcf9, #fdfcf8	no text search of any kind reaches a PNG
tests/test_brand_styles.py	the retired values pinned as expected constants	the test agreed with the bug

What changed

styles/tokens.css and styles/tokens.json are vendored byte-identical from
openadapt-web into docs/stylesheets/vendor/openadapt-web/, hashing to the
same digests Cloud and Desktop recorded:

tokens.css   3697a7c8f7c9f671397a7f678d00354114e0b94c7d13265d3a970ce973b7e7fa
tokens.json  bf52a448c70d1e7333867661d4dd3f25b5ec920705de3739b5e63d5778f0d4f7

brand.css now defines no colour of its own. It maps the canonical tokens onto
Material's variables and derives every tint with color-mix(). Its dark scheme
uses the canonical --inset-* family, so the docs in dark mode and a dark
inset on openadapt.ai are the same two greys. Every link, heading, and footer
state clears WCAG AA, measured from the vendored tokens rather than from a copy
of their values.

All seven warm images are re-vendored from openadapt-web, which owns the
published visual record and re-shot them on the cool palette. Each copy is
byte-identical to its upstream file and hashes to the digest that repository's
provenance manifest records.

image	ground before	ground after
ui/desktop-qualification-cockpit.png	#f2f1ec 76.1%	#f5f7fa 75.8%
ui/business-decision-qualification-capture.png	#f2f1ec 13.3%	#ffffff 21.4%
ui/business-decision-runtime-request.png	#fdfcf9 21.1%	#ffffff 33.9%
ui/mobile-decision-request.jpg	#fdfcf8 12.5%	#ffffff 24.7%
ui/mobile-decision-pending.jpg	#fdfcf8 18.2%	#ffffff 26.3%
ui/mobile-decision-result.jpg	#fdfcf8 13.2%	#ffffff 21.9%
screenshots/dashboard-overview.png	#fdfcf9 32.5%	#ffffff 46.5%
screenshots/for-each-program-graph.png	#ffffff 78.3%	unchanged
showcase/demo.gif	#0d0b1e 94.7%	unchanged
favicon.ico	#ffffff 68.0%	unchanged

Measured, not eyeballed. #fdfcf9 and #fdfcf8 differ by one digit and read
as the same off-white; only measurement separates them.

The guard

tests/test_design_tokens.py runs offline in pytest tests/:

• each vendored copy still hashes to what provenance.json pins
• brand.css redefines no canonical colour token, and carries no literal
  colour at all
• no retired value appears in any shipped stylesheet, template, script, or SVG
• every image under docs/assets is recorded in
  docs/assets/visual-palette.json, still hashes to its record, and has a cool
  ground

The warm-ground rule is mechanical: the dominant colour must have blue >= red.
Every canonical ground satisfies it (#FFFFFF, #F5F7FA, #EDF1F6,
#0B1220) and every retired one fails it (#f2f1ec, #fbfaf6, #fdfcf9,
#fdfcf8, #f4f3ef, #f4f3ed). No allowlist, and no warm palette can satisfy
it. It stops at the dominant colour on purpose: a warm tint below the ground is
usually --accent-halt tinting a halt card, which is a canonical token
behaving correctly.

scripts/vendor_design_tokens.py --check is the online half, in its own CI
job. It fails when a vendored copy drifts from openadapt-web@main — that is,
when the surfaces have come apart again. Nothing is installed for it, so it
cannot break on a lock refresh.

Each of these was verified by reintroducing the regression it exists to catch
and watching the right test fail.

Verified

• pytest tests/ — 289 passed
• python scripts/validate_docs.py — passed
• mkdocs build --strict — passed
• The built site served locally and read through the browser:
  --surface #F5F7FA, --ink #0B1220, --accent-verified #0B7A5A,
  body background rgb(245, 247, 250), prose link rgb(11, 122, 90). Dark
  scheme: background rgb(11, 18, 32), link rgb(52, 211, 153), body text at
  14.7:1.

Note for reviewers

docs/assets/screenshots/PROVENANCE.txt is also touched by #165. This branch
edits only the dashboard-overview.png entry and one header sentence, to keep
that overlap as small as possible. #165 is not modified here.