refactor(web-ui): tighten theme color governance

[limityan]

Summary

• Expands the theme color governance cleanup to all remaining safe app/component surfaces, including CodeEditor, editor adornments, StreamText/TextStroke, pixel pet, tool cards, Flow Chat capture fallback, language identity, Prism syntax, review team, agent capability, insights, and template context accents.
• Moves fixed role/identity colors into explicit registries and converts component-only decorative literals into same-file private RGB channels, preserving exact previous color values where semantic token substitution would have changed the UI.
• Tightens the audit baseline on latest gcwing/main (d8f2d2e2) so ordinary app/component raw colors, token-equivalent literals, near color pairs, and CSS var governance errors remain at zero.

Refs #1197

Audit impact

Metric	Before (gcwing/main)	After
Scanned production frontend files	1526	1526
Files with color literals	75	26
Color literal occurrences	1930	1718
Unique color literals	1038	913
Component/non-token color occurrences	273	0
Component/non-token unique colors	233	0
App UI color occurrences	108	0
App UI unique colors	94	0
var(--token, fallback) occurrences	31	25
fallback unique tokens	10	7
token-equivalent app literal occurrences	13	0
token-equivalent app literal unique colors	11	0
near color pairs needing evidence	35	0
indistinguishable component color pairs	0	0
CSS var hard errors	0	0

Retained domains

The remaining color literals are deliberately scoped to explicit owner domains rather than ordinary app UI: theme presets/runtime, token contracts, boundary fallback, Mermaid, Monaco/editor, Prism syntax, terminal ANSI, language identity, and the UI exception registry. The exception/boundary counts rise because formerly scattered fixed identity colors and isolated-surface fallbacks are now classified in registries with owners, not because new free-floating app colors were added.

Risk review

• Dynamic color inputs were preserved. No bracket-style dynamic access was added for UI_EXCEPTION_ACCENTS, BUILTIN_LANGUAGE_ACCENTS, or SHARED_PRISM_COLOR_SCHEME; mapped usages are typed records or direct static property access.
• Colors that could be visually meaningful in adjacent or stateful UI were not merged by similarity alone. Exact-value private RGB channels are used for local effects where replacing with a semantic token would have changed the rendered color.
• Re-review after rebasing to d8f2d2e2 corrected three drift risks: reStructuredText identity remains #141414, ContextCompressionCard keeps its previous fixed dark surface through private RGB channels, and DiffEditor keeps its GitHub-style added/deleted RGB channels instead of inheriting global git tokens.
• Monaco/editor, terminal, Mermaid, syntax, language identity, and theme preset palettes remain domain-owned. Further reduction there should be handled as palette redesign, not ordinary token cleanup.
• The config select chevron is still CSS-rendered to avoid reintroducing a data-URI raw color; the color is preserved through a private RGB channel.

Validation

• git fetch gcwing main
• git rebase gcwing/main
• git rev-list --left-right --count gcwing/main...HEAD -> 0 2
• git merge-base --is-ancestor gcwing/main HEAD
• pnpm run theme:color-audit
• git diff --check
• pnpm run lint:web (passes with 4 existing warnings outside this diff)
• pnpm run type-check:web
• pnpm --dir src/web-ui run test:run (213 files, 1178 tests)
• pnpm run build:web (passes; existing Vite chunk/dynamic import warnings remain)