refactor(theme): trim unused installer and git token surface

[limityan]

Summary

• Retired unused web git CSS/runtime alias keys for pull/push and unconsumed border/hover variants while keeping the canonical branch, staged, added, changes, and deleted rendering keys.
• Reduced the installer theme projection to the keys the simple installer UI actually renders: primary/secondary backgrounds, primary/secondary/muted text, essential element/border/status tokens, and the accent ramp.
• Added installer-shell to the visual governance contract so installer theme changes are an actual required surface in theme:visual-contract, not only a documentation row.
• Updated the theme governance baselines and optimization document with the new contract counts, risk boundaries, and non-merge rationale for adjacent or identity-bearing near colors.

Metrics

Scope	Before	After
Web UI color occurrences	601	599
Web UI CSS var definitions	956	945
Web UI contract definitions	591	580
Web token-contract occurrences	115	113
Installer color occurrences	88	81
Installer unique colors	72	66
Installer CSS var definitions	54	30
Installer dynamic families	2	1
Visual governance required surfaces	9	10

Risk Review

• Deleted web git keys were verified to have no production reads; remaining git keys are still consumed by git diff, file tree, filter pill, notification, and editor surfaces.
• Installer no longer mirrors main-app purple/info/tooltip/full-surface tokens; this keeps the installer extension surface intentionally small and avoids TS/Rust duplicate ownership.
• Adjacent or meaningfully distinct near colors were preserved: CLI diff body/gutter pairs, installer theme-card primary/secondary backgrounds, web overlay state ladders, and added/staged git semantics where themes can intentionally diverge.
• No Rust-side theme ownership was added; this PR keeps web and installer color ownership in their existing TS roots and only updates the JS governance contract.

Independent Review

• Architect subagent: no Critical/High/Medium/Low findings. Verified PR head alignment, deleted-key reads, installer schema consumers, dynamic family governance, and theme audit output.
• Product design subagent: no blocking findings. Identified one low governance gap where installer-shell existed in docs but not in the visual contract; fixed by adding the required installer surface and evidence requirements.

Verification

• pnpm run theme:color-audit:all
• pnpm run theme:color-audit:test
• pnpm run theme:visual-contract (10 surfaces, 10 required surfaces covered)
• pnpm run type-check:web
• pnpm run lint:web
• pnpm --dir src/web-ui run test:run (224 files / 1305 tests)
• pnpm --dir BitFun-Installer run build
• git diff --check
• Rebased on latest gcwing/main; git rev-list --left-right --count gcwing/main...HEAD = 0 1

Local note: pnpm run installer:build was attempted twice but timed out during the release desktop payload build before producing failure diagnostics, so the installer frontend build above is the completed local installer verification.