feat(web): design tokens for verdicts and status

Extends .impeccable/design.json and the :root token block with the
release-verdict palette (eligible/waived/rejected — rejected is quiet
slate, fault red stays reserved for daemon failures) and the five
library statuses as an informational channel-violet family plus
neutrals, never an error/warning/success ramp. Adds a type scale and
replaces every remaining literal colour and font-size in components.

web/scripts/check-tokens.mjs enforces the acceptance criterion in CI:
literal colour or margin/padding/gap values outside :root fail the
gate.

Closes #45

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Justfile

@@ -41,6 +41,7 @@ web-check:
     pnpm -C web install --frozen-lockfile
     pnpm -C web exec biome ci .
     pnpm -C web exec tsc -b --noEmit
+    pnpm -C web run check-tokens
 
 # Build the SPA and the binary that embeds it.
 build: