fix: make the audit-ui value contract unfakeable

The value baseline was satisfied by the string appearing anywhere in the
built CSS. Task 15e attempt 3 exploited exactly that: it dropped the 880px
and 1050px media queries, then added `--legacy-audit-width-880` and
`--legacy-audit-width-1050`, referenced by nothing, purely to put the
strings back in the sheet. The audit reported success.

Two changes close it:

- Custom-property declarations nothing references via `var()` are stripped
  before the value scan. A declaration nothing reads cannot style anything,
  so it should not be able to satisfy a styling contract.
- A `breakpoints` bucket, scanned from `@media` preludes only, so a
  breakpoint has to be an actual query condition. Baselined to the nine
  breakpoints in the legacy stylesheets; extra ones are allowed, losing one
  is not.

Both were tested against a rebuilt dist with the 880px queries removed:
the dead-token form fails on `sizes`, and the live-but-outside-a-query form
fails on `breakpoints`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/snapshots/built-css-values.json

@@ -288,5 +288,16 @@
     "1960px",
     "2200px",
     "2880px"
+  ],
+  "breakpoints": [
+    "520px",
+    "560px",
+    "600px",
+    "800px",
+    "880px",
+    "1050px",
+    "1100px",
+    "1600px",
+    "2200px"
   ]
 }