Packed plain-CSS consumer check for token roles; fix installation code fence (#66)

[joeblau]

Closes #66. Chart follow-up: bloxwap/chart#54 deletes styles/hig-roles.generated.css. #65 was closed by #75; its acceptance checks were re-run here and still pass.

What this adds

#75 shipped the radius, type, motion and density roles in @bloxwap/hig-tokens/css, the drift negative test and the docs. This PR adds the remaining proof for the second #66 criterion ("a plain CSS consumer can style with the roles without reading the manifest"):

• npm run smoke:packed-css (scripts/packed-css-smoke.mjs, new CI step after smoke:packed-next):
  • packs @bloxwap/hig-tokens and installs only that tarball into an empty consumer;
  • links @bloxwap/hig-tokens/css (resolved from the package's exports["./css"]) from a script-free HTML page whose own stylesheet uses nothing but --hig-radius-*, --hig-type-*, --hig-motion-* and --hig-density-*;
  • in Chromium, Firefox and WebKit checks computed values against packages/tokens/source.json: radius px, type size/line-height/weight longhands and the --hig-type-<role> font shorthand (first family Bloxwap Sans), motion durations + standard easing, 0s under prefers-reduced-motion: reduce and [data-hig-motion='reduced'], and density control/target/gap in default and [data-hig-density='compact'];
  • fails if the page requests anything except the HTML, its stylesheet and the token CSS, so the manifest and JS are never read.
• Chart follow-up (third Ship radius, type, motion and density roles in @bloxwap/hig-tokens/css #66 criterion): bloxwap/chart#54 re-vendors the d7ff478 candidate, reads the roles from @bloxwap/hig-tokens/css and deletes styles/hig-roles.generated.css and its generator. It also drops Chart's .hig-button font bridge (HIG control CSS should use token font variables, not literal family names #65) and moves its OG TTFs to @bloxwap/hig-native-fonts (Move native TTFs out of the web @bloxwap/hig-tokens package #64). planning/adoption.json (both Chart rows) and docs/governance/new-repository.md link it.
• Docs fix: in docs/installation.md (Tokens only / plain CSS), the closing code fence of the role example shared a line with the next paragraph, so everything after it rendered as one code block on the docs site. Fixed, and the smoke is documented there and in docs/governance/release.md.

Verification (local, macOS arm64, Node 22.22.0 / npm 11.6.1)

Command	Result
npm run check (build, lint + check-drift, typecheck, vitest, native jest)	pass: vitest 16 files / 97 tests, jest 2 suites / 47 tests
npm run quality (after npm run generate:fonts)	pass, scoped anti-drift passed (73 files, 2 dated exceptions)
npm run smoke:packed-css (automated browser, headless Playwright)	pass in Chromium and WebKit. Firefox headless could not launch in this local macOS sandbox (sandbox_extension_issue_file_to_process … Operation not permitted); CI on Linux runs all three engines
Negative: changed --hig-density-compact-gap in the built CSS	smoke:packed-css fails with #density-compact columnGap actual '12px' expected '8px'
tests/quality.test.ts stale-role negative (from #75)	pass: check-drift.mjs exits non-zero with Stale generated artifact
#65 re-check: npm run smoke:packed then smoke:packed-next (automated browser, Chromium)	pass. .hig-button → BloxwapSans, "Bloxwap Sans Scripts", … and .hig-number → BloxwapMono, …, both check: true, loaded: true; the plain @font-face path is covered by browser-smoke in CI

No package source, token values or visual baselines change. No publish, tag or release.

🤖 Generated with Claude Code