refactor(tokens): make token layer authoritative and wire to layout

- Imported tokens.css directly into BaseLayout.astro.
- Removed legacy :root variable definitions from chapters.css, skills-review/styles.css, rules/styles.css, and styles.css.
- Added self-hosted --font-sans and --font-mono to tokens.css and updated legacy font stacks.
- Removed base.css.
- Added a build-output check in check-tokens.mjs to ensure the token layer is loaded in dist html files.

.agents/scripts/check-tokens.mjs

@@ -104,4 +104,46 @@ if (findings.length) {
   findings.forEach((finding) => console.error(`  ${finding}`));
   process.exit(1);
 }
+
+import { existsSync } from 'node:fs';
+import { basename } from 'node:path';
+
+if (existsSync('dist')) {
+  const builtCss = walk('dist').filter((p) => p.endsWith('.css'));
+  const tokensBuilt = builtCss.find((p) => /[\\/]tokens\.[^\\/]+\.css$/.test(p));
+
+  if (!tokensBuilt) {
+    console.error('token check failed — tokens.css was not built into dist/');
+    process.exit(1);
+  }
+
+  const tokensContent = readFileSync(tokensBuilt, 'utf8');
+  if (!tokensContent.includes('#527f9f')) {
+    console.error(
+      'token check failed — built tokens.css does not contain the canonical --blue value #527f9f',
+    );
+    process.exit(1);
+  }
+
+  const htmlFiles = walk('dist').filter(
+    (p) =>
+      p.endsWith('.html') &&
+      !p.includes('/hands-on/') &&
+      !p.includes('\\hands-on\\') &&
+      !p.includes('/submitted-skills/') &&
+      !p.includes('\\submitted-skills\\'),
+  );
+
+  const tokenChunkName = basename(tokensBuilt);
+  for (const html of htmlFiles) {
+    const content = readFileSync(html, 'utf8');
+    if (!content.includes(tokenChunkName)) {
+      console.error(
+        `token check failed — ${html} does not load the token layer (${tokenChunkName})`,
+      );
+      process.exit(1);
+    }
+  }
+}
+
 console.log('token check passed');