feat(01-04): automated off-token audit (GREEN) — D-13

- audit.mjs: zero-dep rendered-CSS scanner — flags off-token hex/rgb()/hsl()
  literals, non-sanctioned font families, non-zero border-radius, box-shadow,
  backdrop-filter, blur/drop-shadow; violations printed as file:line: declaration
- drift guards (exit 2): <40 color tokens, any non-zero --radius-* token,
  missing token sheet / registered page / CSS input — no silent passes (T-1-07)
- scope adjudication: framework layers + @property --tw-* skipped; @layer
  utilities audited only for classes used by implementation pages (mockup
  vocabulary is reference material, D-06; sheet/basemap pages are the registry)
- token-hue+alpha 8-digit forms sanctioned; rounded-full sanctioned as circle
  primitive (spec geometry — puck/medallion signets); 50% radius stays flagged
- wired: theme npm audit + test scripts (root audit delegate resolves)

theme/package.json

@@ -13,6 +13,8 @@
     "send": "mkdir -p dist/fonts && cp -r fonts/geist fonts/space-grotesk dist/fonts/",
     "sheet": "npm run build && echo 'open theme/src/sheet.html in browser ( Consumes theme/dist/rams.css )'",
     "basemap": "node basemap/build.mjs",
-    "basemap:preview": "python3 -m http.server 8123"
+    "basemap:preview": "python3 -m http.server 8123",
+    "audit": "node ./scripts/audit.mjs ./dist/rams.css",
+    "test": "node ./scripts/audit.test.mjs"
   }
 }