Bring CI onto the current template; archetype B with real unit tests

[timdixon82]

Archetype decision

Archetype B (static-app), not content-only. assets/theme.js (the shared
theme-bootstrap script, loaded via <script src="assets/theme.js"> before
paint) has genuine, non-trivial logic: theme resolution from localStorage
and prefers-color-scheme, validation against the four required themes with
a safe fallback, and toggleMode/toggleFamily string transforms. A bug
here is a real accessibility defect (wrong or non-AAA-compliant theme
applied), not a markup issue, so it gets real Vitest coverage rather than a
static-content declaration. .github/ci-archetype is added as static-app.

What changed

• Replaced ci.yml, accessibility.yml, security.yml, codeql.yml with
  the current merged template versions (current SHA pins, manifest gating,
  the .github/ci-archetype check, the Chrome/ChromeDriver matching
  action). The repo's previous ci.yml predated the template's build+test
  mechanism and only ran lint; the repo had no lint.yml at all.
• Added the missing lint.yml, .github/lint-tools/, and
  .github/accessibility-tools/ from the template.
• Added vitest + jsdom, vitest.config.js, and assets/theme.test.js
  (15 tests) covering theme.js's initial resolution (saved theme vs OS
  preference vs invalid value) and its set/toggleMode/toggleFamily
  helpers.
• Updated eslint.config.js so the new test and config files lint
  correctly as ES modules (the project's own runtime script stays
  sourceType: 'script', unchanged).
• Reworked deploy.yml's bundler-free assemble step (this repo has a
  package.json for tooling only, no build script, so it uses the
  template's BUNDLED job, which correctly falls back to the allow-list
  path when no dist/ is produced):
  • Dropped the template's default /scripts/***, /styles/***, and
    /data/*** includes: this repo has no such runtime folders, and
    /scripts/*** would have published this repository's own AgentTeam
    tooling scripts (next-q.sh, record-backport.sh,
    sync-from-template.sh, tasks.sh) to the public site.
  • Added /CNAME, needed for the projects.timdixon.net custom domain;
    without it in the published artifact GitHub Pages drops the custom
    domain on the next deploy.
  • Excluded /assets/*.test.js from the assets include, so the new
    Vitest test file isn't shipped to the live site.
• Ran npm audit fix for a moderate js-yaml DoS advisory in the dev
  dependency tree (production dependency tree already had 0
  vulnerabilities).

Verification

• npm test: 15/15 passing (Vitest, jsdom environment).
• npm run lint: clean (html-validate, stylelint, eslint).
• npm run build --if-present: no-op, as expected (no build script).
• Deploy allow-list dry run (rsync with the updated filter set) against
  the working tree: publishes exactly index.html, CNAME, and
  assets/** (analytics, CSS, fonts, theme.js) — no test file, no
  .github, no repo tooling scripts, no config files.
• Pa11y (--standard WCAG2AAA --config pa11y.json, local Chrome) against
  the served page: No issues found.
• axe-core CLI: could not complete locally — this macOS dev machine's
  bundled ChromeDriver could not maintain a session against local Chrome
  (net::ERR_CONNECTION_REFUSED), which looks like a local
  Chrome/ChromeDriver interaction issue on macOS, not a workflow defect.
  CI's browser-actions/setup-chrome step (Ubuntu) installs a matched
  Chrome/ChromeDriver pair and should not hit this; flagging so Carol
  confirms the CI axe-core job is green and, if it is not, treats this as
  a first real finding rather than assuming it's the same local-only gap.
• Accessibility regression suite (docs/patterns/accessibility-regression- suite.md), static front-end entries, checked manually (the
  scripts/accessibility-regression.sh entry-point referenced by the
  pattern does not exist in this repo or the template, so I could not run
  it as a script):
  • S-01, S-02, S-03, S-12: not applicable (no filtering, no roving
    tabindex/jump navigation, no ARIA grid, no modal on this page).
  • S-04, S-05: no opacity-derived text colours; no per-category colour
    tokens outside the four documented, contrast-annotated themes.
  • S-06: eslint --print-config resolves a non-empty config for
    assets/theme.js, assets/theme.test.js, and vitest.config.js.
  • S-07, S-08: no aria-live regions on the page (N/A).
  • S-09: index.html has exactly one <main> landmark plus <header>
    and <footer>.
  • S-10 (focus ring vs background, 3:1 AAA threshold): computed for all
    four themes — light 10.62:1, dark 8.21:1, muted-light 7.99:1,
    muted-dark 9.15:1. All pass.
  • S-11 (form/control border vs background, 3:1): the theme <select>'s
    border (rgba(255,255,255,0.4) over the navy header) blends to
    3.16:1 against the header background. Passes, narrowly — worth a note
    to Simon if the header background or border opacity is ever revised.

No test-coverage carve-out note needed: this is archetype B and the PR
adds the test file alongside the code path it exercises.