feat(web): design tokens for verdicts and status

Extends .impeccable/design.json and the :root token block with the
release-verdict palette (eligible/waived/rejected — rejected is quiet
slate, fault red stays reserved for daemon failures) and the five
library statuses as an informational channel-violet family plus
neutrals, never an error/warning/success ramp. Adds a type scale and
replaces every remaining literal colour and font-size in components.

web/scripts/check-tokens.mjs enforces the acceptance criterion in CI:
literal colour or margin/padding/gap values outside :root fail the
gate.

Closes #45

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/package.json

@@ -9,7 +9,8 @@
     "build": "tsc -b --noEmit && vite build",
     "preview": "vite preview",
     "typecheck": "tsc -b --noEmit",
-    "lint": "biome ci ."
+    "lint": "biome ci .",
+    "check-tokens": "node scripts/check-tokens.mjs"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.8",